E:\@Source\Windows\Intercessor\khelper\objfre\i386\khelper.pdb
Static task
static1
1 signatures
General
-
Target
5f308160b624ff204faf2ef9c6a0964d_JaffaCakes118
-
Size
6KB
-
MD5
5f308160b624ff204faf2ef9c6a0964d
-
SHA1
dac74485b2f05eb8fef323e85a685f746059137b
-
SHA256
be9f2df5b09d04804b264c4ef8e37a03f16bcaab907969c666c7f52414bc3529
-
SHA512
48580c9b12cb8be54db881916aea5e9fe13b7ffd4d74412b6c8c8b117aead5aee7abe330a8832301ca453bc2999055fd054de5b92cec4f3d5af6bfdc1c2981f7
-
SSDEEP
96:L8VU9hanlg7z8pPBF7T2/b/p13tkHDeZuh6ow/1ZTQqReS:L8a9harHtS/b79UecnqkS
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f308160b624ff204faf2ef9c6a0964d_JaffaCakes118
Files
-
5f308160b624ff204faf2ef9c6a0964d_JaffaCakes118.sys windows:5 windows x86 arch:x86
4158660bfd666f2173b8932101567061
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
PsLookupProcessByProcessId
PsGetVersion
MmIsAddressValid
IoGetCurrentProcess
ObReferenceObjectByHandle
ZwOpenProcess
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
ZwTerminateProcess
KeServiceDescriptorTable
DbgPrint
MmUnmapLockedPages
ZwClose
MmSystemRangeStart
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
PsSetCreateProcessNotifyRoutine
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
KeQuerySystemTime
IoFreeMdl
IofCompleteRequest
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 243B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 768B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 640B - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 294B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ