e:\sys\i386\RESSDT.pdb
Static task
static1
General
-
Target
8e07f76f64792a6b1f33117258b1dbc9_JaffaCakes118
-
Size
2KB
-
MD5
8e07f76f64792a6b1f33117258b1dbc9
-
SHA1
98df9e58e6c34b9c7f90c773ee367cead16d621e
-
SHA256
073546d8c24083d15ff534dc76ef918ba9f91965bcd6a1a487588c6e0fe0f99a
-
SHA512
7606238c747861d210456890945203991a719a4813f52c3d2e3faa75dcd47ce8dd8bdd59915f456517afbb7dba3638f70739c780bdeb7e6da66e0265906097de
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8e07f76f64792a6b1f33117258b1dbc9_JaffaCakes118
Files
-
8e07f76f64792a6b1f33117258b1dbc9_JaffaCakes118.sys windows:5 windows x86 arch:x86
0677538ee8e043594f0e1fb14b411a64
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
_except_handler3
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
Sections
.text Size: 640B - Virtual size: 544B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 228B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 402B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ