c:\winddk\7600.16385.0\src\mysrc\objfre_wlh_x86\i386\llck.pdb
Static task
static1
General
-
Target
6506b616f8e79e46a99d069f035588a4_JaffaCakes118
-
Size
4KB
-
MD5
6506b616f8e79e46a99d069f035588a4
-
SHA1
aba1e3f6f9d92e2a7c87c66816e18b4e7dc75138
-
SHA256
17e362ff595725ad458dc3b1436dae766c7697c0d69ddc4cfba791b7e4ce2dc5
-
SHA512
cbccf219c98dae4cef8cfd82d5dffb3343ec7815ad7b5d70194f7ad35984f7fdf722a12753f0fff15dcc2f2004a8538896c238890014d4836bf15d9a0a724f38
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6506b616f8e79e46a99d069f035588a4_JaffaCakes118
Files
-
6506b616f8e79e46a99d069f035588a4_JaffaCakes118.sys windows:6 windows x86 arch:x86
46597bd1d6f77cb058ee203159932f26
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoFreeMdl
MmUnmapLockedPages
ZwQuerySystemInformation
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
KeServiceDescriptorTable
KeTickCount
Sections
.text Size: 1024B - Virtual size: 534B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 162B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 338B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ