c:\users\icyheart\docume~1\visual~1\projects\download\create~1\objfre_wxp_x86\i386\CreateHook.pdb
Static task
static1
General
-
Target
5a7c451986b89a2afcd4a98cd2782c63_JaffaCakes118
-
Size
6KB
-
MD5
5a7c451986b89a2afcd4a98cd2782c63
-
SHA1
cce86c2241cc95727aa641eaf4c7ba0e6697543b
-
SHA256
7d85a244edcdf4eb65291a2bd218ba88799ebb6b6a72475358075c10dd7389e7
-
SHA512
aa310c9cce8c31bc04b4ff67bd8f8d2b79cf5d48ddddd02333d5c396b4f51bd3fb9f539fdc8a73ed8a0cd17fe6eae1286a842a90287701dffc827a277895f7ec
-
SSDEEP
48:AQ+c9WYXn7VM6IU08fsk0sk0almK1ER3zKuHn749o3fTVQaRWt+Atve0mhpKEOsG:rBV08f8mKSR3ez9qflAjef13Cr3B
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5a7c451986b89a2afcd4a98cd2782c63_JaffaCakes118
Files
-
5a7c451986b89a2afcd4a98cd2782c63_JaffaCakes118.sys windows:6 windows x86 arch:x86
5dc5e1879517add633136b415416e9f4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
strchr
DbgPrint
RtlCompareString
RtlInitString
ZwClose
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlFreeAnsiString
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByHandle
memcpy
KeServiceDescriptorTable
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 442B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 610B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 256B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ