e:\passthru\siglow\driver\objfre_wxp_x86\i386\vmware.pdb
Static task
static1
1 signatures
General
-
Target
60cf1ca5a9d35bbe6277fabd01ebd150_JaffaCakes118
-
Size
14KB
-
MD5
60cf1ca5a9d35bbe6277fabd01ebd150
-
SHA1
f91796353b5afe2feead28c88a310e7aed8faa4c
-
SHA256
14d8096d6f9d7a3a56a8e7d7b5aeb6ea2c0e48634aac43f088101925cef3d146
-
SHA512
09a07b05dc146c8d5743afc984799dceb4bb7e205d6b91a5cb8b2d2ff0bfc51f540458ff0f8540cc956309418747786120299c94dfb8cc25379fc36d759d4b11
-
SSDEEP
192:duTZ6dmSH3cXSvOV4vq7dctcoL9H3uCCUPGTnEIGQswTV:dZdmIMimIejG9+Csg6
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 60cf1ca5a9d35bbe6277fabd01ebd150_JaffaCakes118
Files
-
60cf1ca5a9d35bbe6277fabd01ebd150_JaffaCakes118.sys windows:6 windows x86 arch:x86
112a10e87ff78316cc01d256069fa8a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeTickCount
IofCompleteRequest
RtlInitUnicodeString
memset
memcpy
MmMapLockedPagesSpecifyCache
strstr
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisReEnumerateProtocolBindings
NdisIMDeInitializeDeviceInstance
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisIMCancelInitializeDeviceInstance
NdisIMNotifyPnPEvent
NdisQueryPendingIOCount
NdisCloseAdapter
NdisSetEvent
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisIMGetCurrentPacketStack
NdisRequest
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisReturnPackets
NdisGetPoolFromPacket
NdisCancelSendPackets
NdisFreePacketPool
NdisFreeMemory
NdisAllocateMemory
NdisWaitEvent
NdisResetEvent
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisMSleep
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
NdisDprFreePacket
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 349B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 634B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ