D:\codespace\project\kbw\src\kbwSpace_b2\driver\objfre\i386\kbwdriver.pdb
General
-
Target
5a39a0178f147af19c71671794a7f03b_JaffaCakes118
-
Size
14KB
-
MD5
5a39a0178f147af19c71671794a7f03b
-
SHA1
89e1f0d247e60d924f8cf50dd96b0f3be1c80f28
-
SHA256
7766bc02085ee52ed55324d11f389a0cf9455d765880aaf834717ab3b38e234c
-
SHA512
2c61ba77234cf48c8504d375860ce9bb77da999b6f0a647fc111b0089b5648970183c19ec736922f43d8a6e793858bc61eb2309bd6787655f828959b155cff67
-
SSDEEP
192:6CTwnUrve1abR/6lTyMak5OXWSz6g86u8kScOBJxAbmZqdZ3unxn:rGUj0ab1wwLXWSz6g818EcAbIoQx
Score
7/10
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a39a0178f147af19c71671794a7f03b_JaffaCakes118
Files
-
5a39a0178f147af19c71671794a7f03b_JaffaCakes118.sys windows:5 windows x86 arch:x86
eebe5574b486b5aecf953c95f134fa45
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwCreateKey
DbgPrint
IofCompleteRequest
KeDelayExecutionThread
ZwClose
ExFreePoolWithTag
IoDeleteDevice
IoUnregisterShutdownNotification
IoDeleteSymbolicLink
RtlInitUnicodeString
wcscpy
wcslen
wcscat
PsCreateSystemThread
ZwYieldExecution
IoRegisterShutdownNotification
IoCreateSymbolicLink
ZwOpenKey
RtlCopyUnicodeString
ExAllocatePoolWithTag
ZwQuerySystemInformation
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwAdjustPrivilegesToken
ZwOpenFile
KeServiceDescriptorTable
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwCreateSection
RtlFreeUnicodeString
swprintf
RtlQueryRegistryValues
ZwDeviceIoControlFile
ZwQueryValueKey
IoCreateDevice
ZwSetValueKey
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 896B - Virtual size: 844B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ