c:\WORK\Dok\PassThruEx\objfre_wxp_x86\i386\passthru.pdb
Static task
static1
1 signatures
General
-
Target
780ab5b3beaaa28abfe5c8b226ce9a51_JaffaCakes118
-
Size
165KB
-
MD5
780ab5b3beaaa28abfe5c8b226ce9a51
-
SHA1
6edd110bfb588c24900f0b6ed9aa730fa766f3aa
-
SHA256
2035d88f7475e3fcf408183fc691af6ef580a28535af9f82f1008a5795ececbb
-
SHA512
0ca5387eff2be85352bc725a09dcd1c52c009d2c001888b69883348fbf9c8fe619a8b77bf147ddf5710cedb86017ea7a8294ce4abea82da991eb7d047f7afb5a
-
SSDEEP
1536:+SW0O4ySHGGdZU6Uci3w2fH8L1KAnaZLgFhHgLg+C:+j4ycGMZU3ccw2fHWuchALgp
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 780ab5b3beaaa28abfe5c8b226ce9a51_JaffaCakes118
Files
-
780ab5b3beaaa28abfe5c8b226ce9a51_JaffaCakes118.sys windows:5 windows x86 arch:x86
dca4b6ac3fd5609db401fec649649db4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeBugCheckEx
KeTickCount
KeStackAttachProcess
KeUnstackDetachProcess
ZwCreateFile
KeInitializeApc
ZwReadFile
_allmul
KeDelayExecutionThread
ZwQuerySystemInformation
ExFreePoolWithTag
ExAllocatePoolWithTag
PsLookupProcessByProcessId
PsLookupThreadByThreadId
KeInsertQueueApc
ZwClose
MmMapLockedPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
KeReadStateEvent
KeResetEvent
ExEventObjectType
ObReferenceObjectByHandle
ObfDereferenceObject
IofCompleteRequest
KeSetEvent
memcpy
PsCreateSystemThread
memset
ndis.sys
NdisGetPoolFromPacket
NdisQueryBuffer
NdisQueryBufferOffset
NDIS_BUFFER_TO_SPAN_PAGES
NdisAllocatePacketPool
NdisAllocateBufferPool
NdisAllocateBuffer
NdisFreeSpinLock
NdisInterlockedDecrement
NdisFreePacketPool
NdisInterlockedIncrement
NdisIMCancelInitializeDeviceInstance
NdisIMDeInitializeDeviceInstance
NdisReEnumerateProtocolBindings
NdisIMNotifyPnPEvent
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisFreeMemory
NdisFreeBuffer
NdisDprFreePacket
NdisDeregisterProtocol
NdisOpenProtocolConfiguration
NdisReadConfiguration
NdisAllocateMemoryWithTag
NdisInitializeEvent
NdisAllocatePacketPoolEx
NdisOpenAdapter
NdisIMInitializeDeviceInstanceEx
NdisCloseConfiguration
NdisAllocateSpinLock
NdisInitializeWrapper
NdisIMRegisterLayeredMiniport
NdisMRegisterUnloadHandler
NdisRegisterProtocol
NdisSetEvent
NdisReleaseSpinLock
NdisAcquireSpinLock
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisSend
NdisIMGetCurrentPacketStack
NdisRequest
NdisReturnPackets
NdisTransferData
NdisWaitEvent
NdisCloseAdapter
NdisResetEvent
NdisCancelSendPackets
NdisMRegisterDevice
NdisInitUnicodeString
NdisMSleep
NdisMDeregisterDevice
NdisIMDeregisterLayeredMiniport
NdisTerminateWrapper
NdisIMAssociateMiniport
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 480B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.arch Size: 143KB - Virtual size: 143KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ