E:\passthru\lendot\driver\objfre\i386\lendot.pdb
Static task
static1
1 signatures
General
-
Target
6976fc778ece8f6282d7868ce6c6cc77_JaffaCakes118
-
Size
19KB
-
MD5
6976fc778ece8f6282d7868ce6c6cc77
-
SHA1
58142d12d997ad264f6b7cb5038ba259c8ff4e5d
-
SHA256
28d6531cae7f6a70c456a5df0ed523c7e564a73bbb28c916473214e9a17a3a72
-
SHA512
cabf355fbfe165305bcafc1e1f241e91ba7c8d62fdbac48b4eedb27de480558476dc3e529d28b84a2d7abaa7f764e8176de3a7f3025ceec1ed4ef1b273dd5bdf
-
SSDEEP
192:Tw7z0lEeHmNhRfmIftr+kuZ6Y4H6zhy6JFMCoeURDht7dp6w3lhCG+bUcn5igNiT:kIlGNhBt1uZ6Oy0AVht7B4bn9E5RBIZG
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6976fc778ece8f6282d7868ce6c6cc77_JaffaCakes118
Files
-
6976fc778ece8f6282d7868ce6c6cc77_JaffaCakes118.sys windows:5 windows x86 arch:x86
6cebe041398da9ce2f7fa658445519d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
strstr
ndis.sys
NdisDeregisterProtocol
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisSetEvent
NdisReleaseSpinLock
NdisAcquireSpinLock
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisSend
NdisIMGetCurrentPacketStack
NdisFreeMemory
NdisQueryBufferSafe
NdisAllocateMemory
NDIS_BUFFER_TO_SPAN_PAGES
NdisQueryBufferOffset
NdisRequest
NdisReturnPackets
NdisGetPoolFromPacket
NdisTransferData
NdisCancelSendPackets
NdisFreePacketPool
NdisWaitEvent
NdisCloseAdapter
NdisResetEvent
NdisMDeregisterDevice
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisInitUnicodeString
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisAllocateSpinLock
NdisMRegisterDevice
NdisMSleep
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
NdisDprFreePacket
NdisDprAllocatePacket
NdisGetReceivedPacket
NdisIMNotifyPnPEvent
NdisReEnumerateProtocolBindings
NdisQueryPendingIOCount
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 341B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 920B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 592B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ