c:\z\x\objfre_wnet_amd64\amd64\ffe.pdb
Static task
static1
General
-
Target
4dce51ac7341f854ade157f355af61ad_JaffaCakes118
-
Size
33KB
-
MD5
4dce51ac7341f854ade157f355af61ad
-
SHA1
a989fbca9eaad6c26b60a46d6b3a4624ca528e1b
-
SHA256
8fff4ea5fc319a00a920005ede04c4eec837259208d1927a6c18cce6d9b38175
-
SHA512
c2968e8c3ee96570f1b8f221f7cd46ab6f7a72270034cd55eea5a4764183b1bc193b0efdb6280ee0ab4dda24a7632062f0f6b2d5e56394a068417e7d40f74559
-
SSDEEP
768:pCCAfaNDkVIbihs44TxjwjZJz+ywSwnSvCsEL312Fjh:hNDkedxjmDR18Mjh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4dce51ac7341f854ade157f355af61ad_JaffaCakes118
Files
-
4dce51ac7341f854ade157f355af61ad_JaffaCakes118.sys windows:6 windows x64 arch:x64
f978c9d9139bd3dd262aae448e74016b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoDetachDevice
ObfDereferenceObject
IofCallDriver
IoFreeMdl
IoAllocateMdl
IoBuildDeviceIoControlRequest
MmBuildMdlForNonPagedPool
PsGetCurrentProcessId
ExFreePoolWithTag
KeInitializeTimer
KeRemoveQueueDpc
KeCancelTimer
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
MmMapLockedPagesSpecifyCache
KeSetTimer
swprintf
RtlAppendUnicodeToString
RtlInitUnicodeString
IoGetDeviceObjectPointer
IoAttachDeviceToDeviceStack
KeBugCheckEx
KeInitializeDpc
ExAllocatePoolWithTag
tdi.sys
TdiMapUserRequest
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 888B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ