mcd.pdb
Static task
static1
1 signatures
General
-
Target
896bd0b6420a216b42e8c2e62bb6e10e_JaffaCakes118
-
Size
22KB
-
MD5
896bd0b6420a216b42e8c2e62bb6e10e
-
SHA1
08c2dc2a0c7a5482a2a1bbe8e17667c3a8ea4ec2
-
SHA256
fad3d0c316a18b0a60d4d435d76f3b6cce77e84db42b64cafade451905717ed4
-
SHA512
f6e9e1a1e34897295cf737cf2c448b16360f2ecb53060ceff6e56bb6ca38249a36f4ca234f2e450a7c0532de66229395a1129f58032c7ca09bda6425fa439b83
-
SSDEEP
384:GR3hYfnqTyctX4WZCJwWdLZai+sQa7Pj7EJT7KQKF5eU1qUM8VWP8WsD4WZCJwW:GRqfqycVvCVZyAPj7Y6QKXPoUMCWsDvC
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 896bd0b6420a216b42e8c2e62bb6e10e_JaffaCakes118
Files
-
896bd0b6420a216b42e8c2e62bb6e10e_JaffaCakes118.sys windows:5 windows x86 arch:x86
04955ab464ccedc23330b7ab50bca5f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
sprintf
KeInitializeEvent
IofCallDriver
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoAllocateDriverObjectExtension
RtlFreeUnicodeString
swprintf
IoDeleteSymbolicLink
RtlInitUnicodeString
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ExAllocatePoolWithTag
ExFreePoolWithTag
IoGetConfigurationInformation
IoSetHardErrorOrVerifyDevice
IoBuildDeviceIoControlRequest
IoGetDriverObjectExtension
hal
KeGetCurrentIrql
classpnp.sys
ClassClaimDevice
ClassCreateDeviceObject
ClassInitialize
ClassDeleteSrbLookasideList
ClassInitializeSrbLookasideList
ClassGetDescriptor
ClassInitializeMediaChangeDetection
ClassSendSrbSynchronous
ClassUpdateInformationInRegistry
ClassSetMediaChangeState
ClassDisableMediaChangeDetection
ClassDeviceControl
ClassEnableMediaChangeDetection
ClassReleaseRemoveLock
ClassCompleteRequest
ClassWmiCompleteRequest
Exports
Exports
ChangerClassAllocatePool
ChangerClassDebugPrint
ChangerClassFreePool
ChangerClassInitialize
ChangerClassSendSrbSynchronous
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 256B - Virtual size: 221B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cpqy Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 258B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ