c:\work\0047.bho\bho\bho_full_tbws\clever\objfre_wxp_x86\i386\VIDEO.pdb
Static task
static1
1 signatures
General
-
Target
49d5462ceedf1c97a911abc4aefdd3e7_JaffaCakes118
-
Size
29KB
-
MD5
49d5462ceedf1c97a911abc4aefdd3e7
-
SHA1
89ba690754d7546b20c492da85248833f1cb03d5
-
SHA256
38ad23e5fe53548f71316eb503ad581d90c49139a31783dbc692a16b5a46a86c
-
SHA512
8fbe01b70f72e44f9893950295529d5138df8820f324ab7195e229c6626c43da753fa51f47518bd9c8742afc5346e64fa6632f7b9abc17d3b49c9506dd1069c5
-
SSDEEP
384:4YKfJ1onT2A3pggdScaXr6ZCn21ZI/kPwoM+TDhJ0SPk1t8YZadvvs:LKcn9guSjXr6sn2Hw3GJ0SOt9adH
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49d5462ceedf1c97a911abc4aefdd3e7_JaffaCakes118
Files
-
49d5462ceedf1c97a911abc4aefdd3e7_JaffaCakes118.sys windows:6 windows x86 arch:x86
de22d6db58bf86d42eb9eb6454563a46
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_strlwr
ObReferenceObjectByHandle
IoGetCurrentProcess
memset
PsLookupProcessByProcessId
wcsncpy
_wcsicmp
memcpy
IoFreeMdl
MmUnmapLockedPages
ZwQueryDirectoryFile
ZwOpenProcess
ZwTerminateProcess
PsGetVersion
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
ExFreePoolWithTag
ObQueryNameString
ExAllocatePool
KeDelayExecutionThread
ZwClose
ZwWriteFile
_stricmp
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwReadFile
ProbeForRead
ZwQuerySystemInformation
ZwCreateKey
swprintf
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwDeleteKey
ZwOpenKey
ZwDeleteValueKey
wcsstr
ZwEnumerateValueKey
ZwQueryKey
_wcslwr
ZwEnumerateKey
CmRegisterCallback
CmUnRegisterCallback
KeQuerySystemTime
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ZwCreateFile
ObfDereferenceObject
RtlUnwind
hal
KeGetCurrentIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ