D:\vvvvvvvvvvvvvvvvvvvvvvvvvvv.pdb
Static task
static1
1 signatures
General
-
Target
96dd06a4a5ae8cfb0261b7ac63cf3df2_JaffaCakes118
-
Size
3KB
-
MD5
96dd06a4a5ae8cfb0261b7ac63cf3df2
-
SHA1
9d573651166236961e46a808a36480a3257eb43f
-
SHA256
1c1b0f001b5155f1ca0fd33e9f0f017818bfc25e8e47a2060db74cdcf707948e
-
SHA512
f2ac11d4ee0baa3de8b8655473c98bcd6a645423fc6978db812a0ff5400930d1f8a135164c48000bcce9f10201d868cc3c19233a1ee9467292adea9f4f1d5f70
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 96dd06a4a5ae8cfb0261b7ac63cf3df2_JaffaCakes118
Files
-
96dd06a4a5ae8cfb0261b7ac63cf3df2_JaffaCakes118.sys windows:5 windows x86 arch:x86
2bd2b75d86888bce3d1a38eb6799f5af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
IofCompleteRequest
RtlInitUnicodeString
PsLookupProcessByProcessId
ZwClose
DbgPrint
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
MmUnmapViewOfSection
IoCreateFile
hal
KeGetCurrentIrql
Sections
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 744B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ