D:\MyDrivers\KeyEnable(sys)\objfre\i386\KeyEnable.pdb
Static task
static1
General
-
Target
5f50dcc869e6c56491dd5bd0c08414f5_JaffaCakes118
-
Size
5KB
-
MD5
5f50dcc869e6c56491dd5bd0c08414f5
-
SHA1
d81bd4877e4aaeabb55434cb1bf0994b057a5b79
-
SHA256
e14a72a8e7d4093a5cf624fa35b420e543418b4433f19060bfd17e4fa681db7d
-
SHA512
f82cbbc3cb7dcfc18b011e4c809809524914af6edcd44dad81d146cec8838a6f2110941e12e5fdf68db949226d94340c5ec0153a19837fadad43a3d949142d10
-
SSDEEP
48:SgQ3jNh5uZwQAEuLdmr6zKP5RPi2YruMg0V51JRrguULj:hwUwmA52xQ5tHX1g/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5f50dcc869e6c56491dd5bd0c08414f5_JaffaCakes118
Files
-
5f50dcc869e6c56491dd5bd0c08414f5_JaffaCakes118.sys windows:5 windows x86 arch:x86
8e554d0ba94a5cae76c41470473b3dd6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeServiceDescriptorTable
MmIsAddressValid
KeAddSystemServiceTable
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExFreePoolWithTag
ExAllocatePoolWithTag
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 186B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 374B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ