e:\VC\Filter\driver\objfre\i386\Filter.pdb
Static task
static1
1 signatures
General
-
Target
68844978a3a847eb3f51571793fc0bdb_JaffaCakes118
-
Size
13KB
-
MD5
68844978a3a847eb3f51571793fc0bdb
-
SHA1
3f47a99ecd2288b75f0aa33dd5a4df39b1f5c5ef
-
SHA256
07b05f1f3954c35dfd40bfb546cdc6518cf91b3c0c4e5903dc3117dac86ce38f
-
SHA512
707c472f1fc793826cdddde5daa9e37bcb96b5bd49aa21bbd0f608b5ff94029a55845e65456d1262b8070a1488d777d820b83fd51fbfe0de510dfeae394dcaff
-
SSDEEP
192:5pmfqe4aGJGUanxXcEhxKxdFRvy1UdoV7xRCs736g4OoPmPtdqM9fQiTb:mf53rnxMmxKfFRvy37xokKxOoON91T
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 68844978a3a847eb3f51571793fc0bdb_JaffaCakes118
Files
-
68844978a3a847eb3f51571793fc0bdb_JaffaCakes118.sys windows:4 windows x86 arch:x86
8dde044f3eefd55a513a233eec816174
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
RtlInitUnicodeString
strncmp
strstr
memmove
IoDetachDevice
IofCallDriver
strchr
ObfDereferenceObject
RtlAppendUnicodeStringToString
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoRegisterShutdownNotification
IoUnregisterShutdownNotification
IofCompleteRequest
RtlIntegerToUnicodeString
IoGetDeviceObjectPointer
ExFreePoolWithTag
IoCreateDevice
ExAllocatePoolWithTag
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.STL Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 792B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ