D:\KPDrv\objfre\i386\KPDrv.pdb
Static task
static1
General
-
Target
77510b9511825a54283d70ce9f92962a_JaffaCakes118
-
Size
3KB
-
MD5
77510b9511825a54283d70ce9f92962a
-
SHA1
3e5b5c864e34b5b05d92b6476184ede745fc4f07
-
SHA256
0de70ca2f9c5d204b281c62ce23fc4d1e4197a7ccd25c7e1e2ec28f76ba6ba91
-
SHA512
9e7d67e8a2e60205adf2029bc4c08cb239346da8da73b7dfee999218c6b1e2c126c01ebc151fc26af6f15314359e8cf8f4ec927c3fbc49d1bd56494735c307ef
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 77510b9511825a54283d70ce9f92962a_JaffaCakes118
Files
-
77510b9511825a54283d70ce9f92962a_JaffaCakes118.sys windows:5 windows x86 arch:x86
2be5d4c7d34f01780ed31a60890baee6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePoolWithTag
DbgPrint
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
PsTerminateSystemThread
ObReferenceObjectByHandle
PsCreateSystemThread
ObfDereferenceObject
PsLookupProcessByProcessId
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeWaitForSingleObject
MmGetSystemRoutineAddress
hal
KfRaiseIrql
KeGetCurrentIrql
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 163B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 566B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.xiso Size: 128B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE