F:\sysfors\objfre_w2k\i386\live.pdb
Static task
static1
1 signatures
General
-
Target
737bc4f3c734fb71b43b26da891b35e2_JaffaCakes118
-
Size
11KB
-
MD5
737bc4f3c734fb71b43b26da891b35e2
-
SHA1
ea07d22fef79118847c91e5dd5b5f67e978d4300
-
SHA256
4123d90cf6f49f530f7fc33d5a24da91149b5ce16bb37fa465021372dc58c4b7
-
SHA512
a7ed01f1dc31ed6fe11738bb72fe37a3935507404be22ffdce42978faa2acc95f7b979db2b1fc306fbdef8df0fd697d92893763c9a8b11884bc05af69315287f
-
SSDEEP
192:Ntpg92XxWQhKgo36JIezEWUAz8Ck5/ZDmss4/IXQ4:vpgQXx6p36MQ8CkbDmsvsQ
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 737bc4f3c734fb71b43b26da891b35e2_JaffaCakes118
Files
-
737bc4f3c734fb71b43b26da891b35e2_JaffaCakes118.sys windows:5 windows x86 arch:x86
18e74cd9b722c97e921d5a9c36578080
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwCreateFile
ZwClose
ZwQueryValueKey
ZwSetValueKey
ZwCreateKey
KeServiceDescriptorTable
RtlInitUnicodeString
RtlCompareMemory
IofCompleteRequest
IoRegisterDriverReinitialization
RtlFreeAnsiString
IoDeleteDevice
PsSetCreateProcessNotifyRoutine
PsCreateSystemThread
swprintf
mbstowcs
IoCreateSymbolicLink
IoCreateDevice
wcscat
_strlwr
RtlUnicodeStringToAnsiString
wcsrchr
_wcslwr
ZwEnumerateKey
ZwOpenKey
ExFreePool
ExAllocatePoolWithTag
ZwOpenFile
strncmp
IoGetCurrentProcess
PsTerminateSystemThread
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ObfDereferenceObject
KeWaitForSingleObject
ObReferenceObjectByHandle
sprintf
_stricmp
strncpy
PsLookupProcessByProcessId
KeDelayExecutionThread
wcslen
_snprintf
ZwQuerySystemInformation
ZwMapViewOfSection
ZwCreateSection
MmIsAddressValid
ZwUnmapViewOfSection
_except_handler3
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 312B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 768B - Virtual size: 760B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ