tcpip.pdb
Static task
static1
1 signatures
General
-
Target
71c3bb1357e2739d349f1f35c28b1589_JaffaCakes118
-
Size
353KB
-
MD5
71c3bb1357e2739d349f1f35c28b1589
-
SHA1
1b42cbff75dce15eb35623e57009dfbb57b5eb74
-
SHA256
7d0e24504c62ce41aaf2ad6fc4eb241940761a90859647cfb9da782fdddc51fa
-
SHA512
4e51bbfe7cb94bc3bdb00f16a6e3fff270ed33e72e8292a788c7a62d20717b5bf728cd6eca6f5dd43dd9decbc251ea9aa3df2f0f8e7ae8288c252447fb60d045
-
SSDEEP
6144:7JVxTJMCOHOcecOeaVrith/CC/LxGh5wCQCzKLQ/xaczS:7DxTl2OzryZCAQ4CQDQ/
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 71c3bb1357e2739d349f1f35c28b1589_JaffaCakes118
Files
-
71c3bb1357e2739d349f1f35c28b1589_JaffaCakes118.sys windows:5 windows x86 arch:x86
be8f8048c4b29418508dc0c6096b5227
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
KfReleaseSpinLock
KfAcquireSpinLock
KfRaiseIrql
KeGetCurrentIrql
KeQueryPerformanceCounter
ExAcquireFastMutex
ExReleaseFastMutex
ndis.sys
NdisCloseAdapter
NdisCancelSendPackets
NdisFreePacket
NdisUnchainBufferAtFront
NdisCompletePnPEvent
NdisFreePacketPool
NdisRequest
NdisAllocatePacket
NdisFreeMemory
NdisQueryAdapterInstanceName
NdisGetDriverHandle
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisGetReceivedPacket
NdisRegisterProtocol
NdisAllocateBuffer
NdisSetPacketPoolProtocolId
NdisReturnPackets
NdisCopyBuffer
NdisAllocateBufferPool
NdisFreeBufferPool
NdisReEnumerateProtocolBindings
NdisCompleteBindAdapter
ntoskrnl.exe
IoCreateDevice
_wcsicmp
wcscpy
wcsncpy
wcschr
ZwSetInformationThread
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeQueryTimeIncrement
KeSetEvent
IoDeleteSymbolicLink
ExDeleteNPagedLookasideList
KeDelayExecutionThread
ZwOpenKey
KeSetTimerEx
KeInitializeTimer
KeInitializeDpc
ExInitializeNPagedLookasideList
MmLockPagableSectionByHandle
ZwQueryValueKey
ZwSetValueKey
InterlockedPopEntrySList
InterlockedPushEntrySList
ExIsProcessorFeaturePresent
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlMapGenericMask
IoGetFileObjectGenericMapping
ObReleaseObjectSecurity
SeSetSecurityDescriptorInfo
RtlLengthSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ObGetObjectSecurity
IofCallDriver
IoBuildDeviceIoControlRequest
IoGetDeviceObjectPointer
ObfDereferenceObject
RtlAddAce
RtlGetAce
IoCreateSymbolicLink
RtlInitializeSid
RtlLengthRequiredSid
ObSetSecurityObjectByPointer
RtlSelfRelativeToAbsoluteSD
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlVerifyVersionInfo
VerSetConditionMask
IoWMIRegistrationControl
IoGetCurrentProcess
KeInitializeTimerEx
RtlExtendedIntegerMultiply
KeQueryInterruptTime
_aulldiv
DbgBreakPoint
KeSetTargetProcessorDpc
RtlSetBit
SeUnlockSubjectContext
SeAccessCheck
SeLockSubjectContext
ObDereferenceSecurityDescriptor
PsGetCurrentProcessId
RtlWalkFrameChain
ExNotifyCallback
ExCreateCallback
ObReferenceObjectByHandle
MmUnlockPages
SeFreePrivileges
SeAppendPrivileges
ObLogSecurityDescriptor
SeAssignSecurity
IoFileObjectType
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
ProbeForWrite
ObfReferenceObject
PsGetCurrentProcess
RtlPrefetchMemoryNonTemporal
KeInitializeMutex
MmIsThisAnNtAsSystem
KeWaitForSingleObject
KeReleaseMutex
KeReadStateEvent
IoDeleteDevice
ZwEnumerateValueKey
RtlUnicodeStringToInteger
RtlIpv4StringToAddressW
RtlTimeToTimeFields
ExLocalTimeToSystemTime
RtlExtendedMagicDivide
RtlAppendUnicodeToString
ZwClose
_allmul
MmQuerySystemSize
RtlCompareUnicodeString
RtlInitializeBitMap
RtlClearAllBits
RtlSetBits
wcslen
RtlAreBitsSet
RtlClearBits
RtlFindClearBitsAndSet
RtlFindClearRuns
DbgPrint
memmove
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
ZwLoadDriver
KeResetEvent
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
IofCompleteRequest
ExfInterlockedAddUlong
MmMapLockedPagesSpecifyCache
IoFreeMdl
ExfInterlockedInsertTailList
RtlInitUnicodeString
MmMapLockedPages
KeNumberProcessors
RtlUnicodeStringToAnsiString
MmLockPagableDataSection
MmUnlockPagableImageSection
RtlCompareMemory
ExAllocatePoolWithTag
KeCancelTimer
KeClearEvent
RtlAnsiStringToUnicodeString
IoRaiseInformationalHardError
KeInitializeEvent
ExFreePoolWithTag
ExAllocatePoolWithTagPriority
KeInitializeSpinLock
_alldiv
KeQuerySystemTime
KefAcquireSpinLockAtDpcLevel
KefReleaseSpinLockFromDpcLevel
KeBugCheckEx
RtlSubAuthoritySid
KeTickCount
MmBuildMdlForNonPagedPool
ZwDeviceIoControlFile
ZwCreateFile
tdi.sys
CTESystemUpTime
CTEBlock
CTELogEvent
CTESignal
CTEBlockWithTracker
CTEStartTimer
CTEInitEvent
CTEScheduleDelayedEvent
CTEInitTimer
TdiProviderReady
CTEInitialize
TdiDeregisterNetAddress
TdiRegisterNetAddress
TdiDeregisterDeviceObject
TdiRegisterDeviceObject
TdiDeregisterProvider
TdiRegisterProvider
TdiPnPPowerRequest
TdiCopyMdlChainToMdlChain
TdiInitialize
TdiDeregisterPnPHandlers
TdiRegisterPnPHandlers
CTEScheduleEvent
TdiCopyBufferToMdl
CTERemoveBlockTracker
CTEInsertBlockTracker
TdiMapUserRequest
TdiCopyBufferToMdlWithReservedMappingAtDpcLevel
Exports
Exports
ARPRcv
ARPRcvPacket
FreeIprBuff
GetIFAndLink
IPAddInterface
IPAllocBuff
IPDelInterface
IPDelayedNdisReEnumerateBindings
IPDeregisterARP
IPDisableSniffer
IPEnableSniffer
IPFreeBuff
IPGetAddrType
IPGetBestInterface
IPGetInfo
IPInjectPkt
IPProxyNdisRequest
IPRcvComplete
IPRcvPacket
IPRegisterARP
IPRegisterProtocol
IPSetIPSecStatus
IPTransmit
LookupRoute
LookupRouteInformation
LookupRouteInformationWithBuffer
SendICMPErr
SetIPSecPtr
UnSetIPSecPtr
UnSetIPSecSendPtr
tcpxsum
Sections
.text Size: 252KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEIPMc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 896B - Virtual size: 833B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ