e:\passthru\siglow\driver\objfre_wxp_x86\i386\vmware.pdb
Static task
static1
1 signatures
General
-
Target
87c48a85382c3d4db34ef9c8514f8f81_JaffaCakes118
-
Size
14KB
-
MD5
87c48a85382c3d4db34ef9c8514f8f81
-
SHA1
6b76216f9b4230776f5b93b5725c3437ffa18ce5
-
SHA256
2bfb10bc7c3fd6638624ba1c8de114ff08730893f3834d3096da42e1f33e5368
-
SHA512
a431795497f06ee18f08ffec006b98285bb3eeb8dab79512870b2bc14279c71d1ff0a2571531744476f8c27be4712356100a4cb26e0cc223dacd45f716e55de2
-
SSDEEP
192:nu5QsmSHlwZSvOV4vq7PacVUoL9e35MCCUPGTnEIGQsw+P:naQsmIe8mIePP9oMCsgR
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 87c48a85382c3d4db34ef9c8514f8f81_JaffaCakes118
Files
-
87c48a85382c3d4db34ef9c8514f8f81_JaffaCakes118.sys windows:6 windows x86 arch:x86
112a10e87ff78316cc01d256069fa8a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeTickCount
IofCompleteRequest
RtlInitUnicodeString
memset
memcpy
MmMapLockedPagesSpecifyCache
strstr
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisReEnumerateProtocolBindings
NdisIMDeInitializeDeviceInstance
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisIMCancelInitializeDeviceInstance
NdisIMNotifyPnPEvent
NdisQueryPendingIOCount
NdisCloseAdapter
NdisSetEvent
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisIMGetCurrentPacketStack
NdisRequest
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisReturnPackets
NdisGetPoolFromPacket
NdisCancelSendPackets
NdisFreePacketPool
NdisFreeMemory
NdisAllocateMemory
NdisWaitEvent
NdisResetEvent
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisMSleep
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
NdisDprFreePacket
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 349B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 634B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ