D:\Work\MyProjects\VideoCach\Loader\__conf_conf3\protect-driver\objfre\i386\ppdriver.pdb
Static task
static1
General
-
Target
897e688172ed065843e153f9ea1904fe_JaffaCakes118
-
Size
2KB
-
MD5
897e688172ed065843e153f9ea1904fe
-
SHA1
3da0888c9ce3a13888ac8fe61fadc1ad9eb4093c
-
SHA256
cf910682b62175d38a43c62b07f04731e8dbedef1b7fff7f04d7471c10e3ce53
-
SHA512
4125606eb6f99c64f665ad845dda3d9a805ba168a98b6e51f80cbb17f407e460d9054bbbe59747d5f490ed78ef115a7d107547f06bea0207e195b43b89fc0ffe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 897e688172ed065843e153f9ea1904fe_JaffaCakes118
Files
-
897e688172ed065843e153f9ea1904fe_JaffaCakes118.sys windows:5 windows x86 arch:x86
c7bc88b46a0b4d32999c27568e16e78f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeServiceDescriptorTable
ZwQuerySystemInformation
DbgPrint
strncmp
IoGetCurrentProcess
strncpy
ObfDereferenceObject
PsLookupProcessByProcessId
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 189B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 314B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 142B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ