C:\WINDOWS\System32\i386\hflt_ipf.pdb
Static task
static1
1 signatures
General
-
Target
4d64a621256fc7768713d609f5c57ee4_JaffaCakes118
-
Size
26KB
-
MD5
4d64a621256fc7768713d609f5c57ee4
-
SHA1
66a7380b9479d1f21c4f444a1d4b633f8e97f033
-
SHA256
42dbb5093494976759e2174a0f510a4d1449860c298edcce8a2662c8277b510f
-
SHA512
25884847a4be441bdd1c3cc8763ac4c4d548e2561095baea6a01323915abdb6d707791fec4b8d03ce2bf90bc135ef0aebf9265584dc990974c223ba853686316
-
SSDEEP
384:pOKUvKy8Awiq7KmWXsvSNPagxvs3w3Fo5HXNEhDzAu:pIKyNwicKJRa8k3wVo/wDUu
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4d64a621256fc7768713d609f5c57ee4_JaffaCakes118
Files
-
4d64a621256fc7768713d609f5c57ee4_JaffaCakes118.sys windows:5 windows x86 arch:x86
3d4fe5bbf7c27dbb9e750792125469df
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeWaitForMultipleObjects
ObReferenceObjectByHandle
NtBuildNumber
_except_handler3
PsTerminateSystemThread
KeWaitForSingleObject
KeSetTimer
KeInitializeTimer
IoGetCurrentProcess
KeResetEvent
KeReleaseMutex
KeSetEvent
RtlVolumeDeviceToDosName
PsCreateSystemThread
KeInitializeEvent
KeInitializeMutex
RtlUpperChar
ObfDereferenceObject
ExAllocatePoolWithTag
ExFreePoolWithTag
RtlUnicodeStringToAnsiString
ZwQueryObject
RtlIntegerToUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwClose
IoCreateFile
ZwQueryValueKey
ZwOpenKey
ZwReadFile
ZwQueryInformationFile
KeTickCount
KeBugCheckEx
MmIsAddressValid
KeServiceDescriptorTable
hal
KeGetCurrentIrql
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 740B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 736B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ