c:\hopper\branches\ng\driverp\5x\sys\objfre_wlh_x86\i386\hopperp.pdb
Static task
static1
1 signatures
General
-
Target
85ce8de80e244a05f538c33031b01ed3_JaffaCakes118
-
Size
22KB
-
MD5
85ce8de80e244a05f538c33031b01ed3
-
SHA1
24be428316f42c1a083590182d0785f7e865a607
-
SHA256
9c7a7da641298a5598b82b6785ca1a7f5d4297806870daaac2c1bf34a1dafa4a
-
SHA512
e6398dd5e6e80a372488d958061698091eb0f9189e771e2e852a1baa6424dc67337be76b314889ff214ce9af47f26c75f0930fb6e7327afd255fcfb294a4e21e
-
SSDEEP
384:K3JHkRTwVCkC8BlLyjvkgT48QXO0FuFvq2tN3wT2:acsNCyN2kgT5abFIh2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 85ce8de80e244a05f538c33031b01ed3_JaffaCakes118
Files
-
85ce8de80e244a05f538c33031b01ed3_JaffaCakes118.sys windows:6 windows x86 arch:x86
b806e57a814c37d91cda6f19ec106ad7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeBugCheckEx
KeTickCount
MmMapLockedPagesSpecifyCache
IoFreeMdl
IoReleaseCancelSpinLock
IoDeleteDevice
memcpy
memset
IoCreateSymbolicLink
IofCompleteRequest
RtlInitUnicodeString
IoDeleteSymbolicLink
MmGetSystemRoutineAddress
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
ExFreePoolWithTag
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
ExAllocatePoolWithTag
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisUnchainBufferAtFront
NdisFreePacket
NdisReturnPackets
NdisAllocateBuffer
NdisCopyFromPacketToPacket
NdisReadConfiguration
NdisCloseConfiguration
NdisAllocateMemoryWithTag
NdisAllocatePacketPoolEx
NdisAllocateBufferPool
NdisCancelSendPackets
NdisOpenProtocolConfiguration
NdisAllocatePacket
NdisFreeMemory
NdisWaitEvent
NdisGeneratePartialCancelId
NdisRegisterProtocol
NdisInitializeEvent
NdisSetEvent
NdisFreeBufferPool
NdisFreePacketPool
NdisQueryPendingIOCount
NdisDeregisterProtocol
NdisRequest
NdisCloseAdapter
NdisQueryAdapterInstanceName
NdisOpenAdapter
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ