C:\DDK\hfssdt\i386\LoveSbl.pdb
Static task
static1
General
-
Target
93c28b9aa0faaf7ae609d7543bd7d638_JaffaCakes118
-
Size
4KB
-
MD5
93c28b9aa0faaf7ae609d7543bd7d638
-
SHA1
5c81636bd109e1f5b39f21cf43901a3804649a40
-
SHA256
1c62e74277194eb5e9d55dbbb11a89e84c0c283e20adc0fd717ebf7ec49e7ee8
-
SHA512
e99af0eb2d59bd285e4b72a1891b1cde7f8dafddb2c439154dfcdde9da54be519fc1fe35bbd482fbf3ae7d86f5c963faf0d434feea9273d52b5ccee9c6c64878
-
SSDEEP
96:7/KiigOd2B6q3Sz+6s+E1SfkEWKLu+Ww8:uB2B1QkMf1WKq+Wp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 93c28b9aa0faaf7ae609d7543bd7d638_JaffaCakes118
Files
-
93c28b9aa0faaf7ae609d7543bd7d638_JaffaCakes118.sys windows:5 windows x86 arch:x86
e9d4c2e3d2463f8a8d0e53fab8344e34
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
DbgPrint
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
_except_handler3
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 147B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 324B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 104B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ