E:\passthru\siglow\driver\objchk\i386\siglow.pdb
Static task
static1
1 signatures
General
-
Target
7127f2c7471cfd7b7361ab4d36c7a930_JaffaCakes118
-
Size
21KB
-
MD5
7127f2c7471cfd7b7361ab4d36c7a930
-
SHA1
157274b8f828e4510fa2c8cf2e16d165138faadb
-
SHA256
8a5c00ddce4de3c88c749790d994a9e0eca39fa085c436d8e8d5fbc7a35857e5
-
SHA512
11cb7175a8a7f4dc11e4ddf365c77fb0313ac58a7e5e52bdbe0170c0e4060d96a3e9cd9f5c8f2258a3cdefa2276cb34332637815edd9c5e0283202d775f3ba52
-
SSDEEP
384:BTDjZmAv4w6R57lIrvGITM2DZ3Rw6cVx6Xt4sIKtZVpX:Bhww6R57CGMM2dBw6Sx699PtZb
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7127f2c7471cfd7b7361ab4d36c7a930_JaffaCakes118
Files
-
7127f2c7471cfd7b7361ab4d36c7a930_JaffaCakes118.sys windows:5 windows x86 arch:x86
b7402d4b43a639be2e346484763bf911
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
strstr
DbgPrint
RtlAssert
ndis.sys
NdisTerminateWrapper
NdisQueryPendingIOCount
NdisPacketPoolUsage
NdisReEnumerateProtocolBindings
NdisIMNotifyPnPEvent
NdisSetEvent
NdisReleaseSpinLock
NdisAcquireSpinLock
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisSend
NdisIMGetCurrentPacketStack
NdisFreeMemory
NdisQueryBufferSafe
NdisAllocateMemory
NDIS_BUFFER_TO_SPAN_PAGES
NdisQueryBufferOffset
NdisRequest
NdisReturnPackets
NdisGetPoolFromPacket
NdisTransferData
NdisWaitEvent
NdisCloseAdapter
NdisResetEvent
NdisCancelSendPackets
NdisFreePacketPool
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisInitUnicodeString
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisAllocateSpinLock
NdisMRegisterDevice
NdisMSleep
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
NdisIMDeInitializeDeviceInstance
NdisIMCancelInitializeDeviceInstance
NdisDprFreePacket
NdisDprAllocatePacket
NdisGetReceivedPacket
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 357B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ