F:\~unifade\objfre_wxp_x86\i386\unifade.pdb
Static task
static1
General
-
Target
4df33197da641f1c9afe3e1c7c493fc0_JaffaCakes118
-
Size
79KB
-
MD5
4df33197da641f1c9afe3e1c7c493fc0
-
SHA1
09675ec2ec496bcc443fcf498a1239cb6ed12612
-
SHA256
7d18e953b53987d1c283f181d16877f888927de327031ad3a9c29ed3ad9e0275
-
SHA512
8d8605b1427f5df9dcf974ac486b376477a831d2af3a24812aee37c8d43e995b5e9a1485dd7f0ef234ef1b7a9557a94acf5de1282ac3dfee4ff213744f7b11d6
-
SSDEEP
1536:cDM8xMnsto+a4ISXxn2ouvHaQVAB8hn+9nUbAxdnKoL9KWsYCSw+qjaOkU6ZO:cDM8xMns2htS8ouv16EATKI9KWsYCSw5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4df33197da641f1c9afe3e1c7c493fc0_JaffaCakes118
Files
-
4df33197da641f1c9afe3e1c7c493fc0_JaffaCakes118.sys windows:5 windows x86 arch:x86
618ef8cdb86d7c09a2596e66ded4065b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ProbeForRead
_except_handler3
memmove
strncmp
IoGetCurrentProcess
PsGetCurrentProcessId
strncpy
_strnicmp
PsGetVersion
strstr
_wcsnicmp
wcslen
RtlAppendUnicodeToString
wcsstr
_wcslwr
PsSetLoadImageNotifyRoutine
IoFileObjectType
ZwOpenFile
KeServiceDescriptorTable
ZwSetValueKey
InterlockedPushEntrySList
DbgPrint
ExDeleteNPagedLookasideList
InterlockedPopEntrySList
ExInitializeNPagedLookasideList
ExSetTimerResolution
KdDebuggerEnabled
ZwCreateKey
wcscpy
ObQueryNameString
ObfDereferenceObject
ObReferenceObjectByHandle
KeDelayExecutionThread
ZwQueryInformationFile
KeQuerySystemTime
ZwOpenKey
ZwQueryValueKey
RtlCopyUnicodeString
KeInitializeSpinLock
PsCreateSystemThread
IoCreateSymbolicLink
IoRegisterBootDriverReinitialization
RtlGetVersion
IoCreateDevice
IoAttachDeviceToDeviceStack
IoDeleteDevice
KeGetCurrentThread
KeSetPriorityThread
KeResetEvent
IoAllocateIrp
IoAllocateMdl
IoBuildPartialMdl
IoFreeMdl
IoFreeIrp
PoStartNextPowerIrp
PoCallDriver
IofCompleteRequest
KeSetEvent
RtlCompareUnicodeString
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
PsGetCurrentThreadId
_alldiv
ZwCreateFile
ZwQueryVolumeInformationFile
ExAllocatePoolWithTag
ZwFsControlFile
_wcsicmp
ExFreePoolWithTag
IoBuildDeviceIoControlRequest
_allmul
KeInitializeEvent
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
sprintf
RtlInitAnsiString
RtlAnsiStringToUnicodeString
IoGetDeviceObjectPointer
RtlFreeUnicodeString
swprintf
RtlInitUnicodeString
IoCreateFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
atoi
ZwClose
hal
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KeGetCurrentIrql
KfLowerIrql
KfRaiseIrql
KeQueryPerformanceCounter
KfAcquireSpinLock
ndis.sys
NdisMRegisterUnloadHandler
NdisInitUnicodeString
NdisRegisterProtocol
NdisIMAssociateMiniport
NdisTerminateWrapper
NdisIMDeregisterLayeredMiniport
NdisMDeregisterDevice
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisMSleep
NdisReEnumerateProtocolBindings
NdisIMNotifyPnPEvent
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisQueryBufferOffset
NDIS_BUFFER_TO_SPAN_PAGES
NdisCopyFromPacketToPacketSafe
NdisAllocateBuffer
NdisDprFreePacket
NdisDeregisterProtocol
NdisOpenProtocolConfiguration
NdisReadConfiguration
NdisAllocateMemoryWithTag
NdisAllocatePacketPoolEx
NdisAllocateBufferPool
NdisOpenAdapter
NdisQueryAdapterInstanceName
NdisIMRegisterLayeredMiniport
NdisCloseConfiguration
NdisResetEvent
NdisCloseAdapter
NdisWaitEvent
NdisFreeMemory
NdisFreePacketPool
NdisFreeBufferPool
NdisCancelSendPackets
NdisTransferData
NdisGetPoolFromPacket
NdisUnchainBufferAtFront
NdisFreeBuffer
NdisReturnPackets
NdisRequest
NdisIMGetCurrentPacketStack
NdisSend
NdisAllocatePacket
NdisIMCopySendPerPacketInfo
NdisIMCopySendCompletePerPacketInfo
NdisFreePacket
NdisIMGetDeviceContext
NdisMSetAttributesEx
NdisAllocateSpinLock
NdisInitializeEvent
NdisAcquireSpinLock
NdisReleaseSpinLock
NdisSetEvent
NdisInitializeWrapper
NdisMRegisterDevice
NdisDprReleaseSpinLock
NdisDprAcquireSpinLock
NdisQueryBufferSafe
NdisGetFirstBufferFromPacketSafe
NdisIMInitializeDeviceInstanceEx
NdisAllocateMemory
Sections
.text Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ