c:\reliz2\driver_rootkit2\tst_hook\m_hook.pdb
Static task
static1
1 signatures
General
-
Target
63549fbfaf468ae2cc07a737b8b08783_JaffaCakes118
-
Size
69KB
-
MD5
63549fbfaf468ae2cc07a737b8b08783
-
SHA1
4d2d72d04a40ef3bffc6b8365004e9c056107c41
-
SHA256
13462133db6ea41db6026bf91fe2ff7968a225726219eec969289ed6eb6270e7
-
SHA512
5e1048b377694ce73705c9f036b56811ec3e10d645af44330b0f613e2be01539073f9a6cf6e24d7064b87a293983e4d2cbea4e1956a9b3f19a48753ec95232f6
-
SSDEEP
1536:nTGv0Ngwe5dAHfLpVhBx0xAJdVFEmO5G2D/xxGTwYfMoeDe61SrIIt:nKNwJVhBx0xAJdVFEmO5G27xxGTwYfJP
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63549fbfaf468ae2cc07a737b8b08783_JaffaCakes118
Files
-
63549fbfaf468ae2cc07a737b8b08783_JaffaCakes118.sys windows:5 windows x86 arch:x86
d813da8efba3635023e2b0ca070d8005
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ZwClose
_stricmp
strncpy
strchr
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
_wcsicmp
ZwUnmapViewOfSection
wcslen
PsSetLoadImageNotifyRoutine
IofCallDriver
IofCompleteRequest
_strnicmp
IoGetRequestorProcess
PsGetVersion
strncmp
IoGetCurrentProcess
ZwQueryDirectoryFile
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQuerySystemInformation
KeServiceDescriptorTable
IoAttachDeviceToDeviceStack
IoCreateDevice
IoGetDeviceObjectPointer
IoDeleteDevice
IoDetachDevice
ObfDereferenceObject
ExReleaseFastMutexUnsafe
IoCreateSymbolicLink
ExAcquireFastMutexUnsafe
IoDeleteSymbolicLink
KeInitializeEvent
_except_handler3
RtlCompareUnicodeString
ObQueryNameString
ObReferenceObjectByHandle
ZwOpenKey
wcscat
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ProbeForRead
KeTickCount
KeBugCheckEx
InterlockedExchange
ExFreePool
hal
KfAcquireSpinLock
Sections
.text Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ