F:\SSDT\SYS\sys\i386\bat.pdb
Static task
static1
General
-
Target
786d58fe178725ffbfd9fe759d49a823_JaffaCakes118
-
Size
2KB
-
MD5
786d58fe178725ffbfd9fe759d49a823
-
SHA1
d572a3e29fb06a734d66452dcc4a142fbd990cd4
-
SHA256
c3c90fec7a0cd53a0ca4818b479aa61ee2c22556ea89f63aee41e5665d9e9520
-
SHA512
b47e5be6339719f4313624b67f4d0c058d96213d23837b463c9cfd9ee3aa7bb6acea1a83fd7f7adbbe43f6490747016d6c1d31cfda786ded5be2ac788a3fcbbf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 786d58fe178725ffbfd9fe759d49a823_JaffaCakes118
Files
-
786d58fe178725ffbfd9fe759d49a823_JaffaCakes118.sys windows:5 windows x86 arch:x86
069b16424b56dbed268b4221b8fb7c72
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
ProbeForRead
DbgPrint
KeServiceDescriptorTable
ProbeForWrite
_except_handler3
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 181B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 384B - Virtual size: 324B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ