ftdisk.pdb
Static task
static1
1 signatures
General
-
Target
4c3d0c3a131c739cd8c6eacd9248f593_JaffaCakes118
-
Size
122KB
-
MD5
4c3d0c3a131c739cd8c6eacd9248f593
-
SHA1
5afb0eee1711e43cc20726a26cdd2e4cc0836d0b
-
SHA256
312d8befcba6dcf91673441dfc9a80d4ec674acc85f93d8aa82689d616ef7638
-
SHA512
ab5f074e95db16e75c89ba38f1a9024fb610e28b0b9bc80ea94f7f22a92cb829a3c9a8fee4a3912ba3a92c80e3f558e7dae58a9d46a0ed3a15ac8d6fae1c1848
-
SSDEEP
3072:uhdvNbNxPAPY23YB/y0sNfVkwT1nvVNA:qRDmY2oB/y0sNphnvV
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4c3d0c3a131c739cd8c6eacd9248f593_JaffaCakes118
Files
-
4c3d0c3a131c739cd8c6eacd9248f593_JaffaCakes118.sys windows:5 windows x86 arch:x86
3bd9ebbaa28f067d72f14003863c2b19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
HalExamineMBR
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
ObfDereferenceObject
KeQuerySystemTime
ExUuidCreate
_allshr
_allmul
memmove
RtlWriteRegistryValue
RtlQueryRegistryValues
RtlCompareMemory
DbgPrint
ObReferenceObjectByHandle
_purecall
RtlCompareUnicodeString
IoGetDeviceObjectPointer
RtlInitUnicodeString
swprintf
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoRegisterDeviceInterface
IoWMIRegistrationControl
IofCompleteRequest
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
RtlDeleteRegistryValue
RtlCreateRegistryKey
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
KeReleaseSemaphore
IoReleaseCancelSpinLock
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
PsTerminateSystemThread
ExQueueWorkItem
IoRegisterShutdownNotification
KeInitializeSemaphore
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeSpinLock
IoCreateDevice
PoRequestPowerIrp
PoSetPowerState
IoAcquireCancelSpinLock
IoReportTargetDeviceChangeAsynchronous
KeInitializeEvent
KeClearEvent
RtlStringFromGUID
IoSetSystemPartition
ZwClose
ZwFsControlFile
ZwOpenFile
IoInvalidateDeviceRelations
PsCreateSystemThread
RtlEqualUnicodeString
ObfReferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlVolumeDeviceToDosName
KeBugCheckEx
IoGetBootDiskInformation
MmLockPagableDataSection
IoInvalidateDeviceState
IoSetDeviceInterfaceState
IoGetDeviceProperty
IoUnregisterShutdownNotification
_alldiv
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
RtlCopyUnicodeString
IoReportDetectedDevice
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoAllocateIrp
FsRtlIsTotalDeviceFailure
IoFreeIrp
IoReuseIrp
IoBuildPartialMdl
MmUnmapLockedPages
_allrem
_alldvrm
_allshl
MmMapLockedPages
IoRaiseInformationalHardError
KeGetCurrentThread
wcslen
ZwQueryValueKey
ZwOpenKey
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
_except_handler3
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
strncmp
IoReadPartitionTableEx
ExFreePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ