f:\work\0047.bho\bho\bho_full_tbws\clever\objfre_wxp_x86\i386\VIDEO.pdb
Static task
static1
1 signatures
General
-
Target
a02549836889947c35563fc83af9efa2_JaffaCakes118
-
Size
29KB
-
MD5
a02549836889947c35563fc83af9efa2
-
SHA1
c2c2f80be253b86e6a704de857dced0c1794a0c9
-
SHA256
23c1735740dd2a872ab9d7e9e834eb5bbd9b4f94bf9cbe718bdb3dc49ff35606
-
SHA512
caff23d6a2fbc5c91a8264397674a9522ffa35d7d60ec79be8c2ada19f187ce85db2f80de89d76b973fea6ee81a60c41c936a61b89a32c4f555f63ae61400964
-
SSDEEP
384:Vcd2iT2AcDyxShO1GOK3yfbtNYqvSaZ6Pk1t1d7/2:V2woS4GOMywqDZ6Ot1dz2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a02549836889947c35563fc83af9efa2_JaffaCakes118
Files
-
a02549836889947c35563fc83af9efa2_JaffaCakes118.sys windows:6 windows x86 arch:x86
4a419c7c41a6941f6fb5d9abc4de2a5d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_strlwr
strncpy
ObReferenceObjectByHandle
IoGetCurrentProcess
memset
PsLookupProcessByProcessId
wcsncpy
_wcsicmp
memcpy
IoFreeMdl
MmUnmapLockedPages
ZwQueryDirectoryFile
ZwOpenProcess
ZwTerminateProcess
PsGetVersion
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
KeServiceDescriptorTable
ExFreePoolWithTag
ObQueryNameString
ExAllocatePool
KeDelayExecutionThread
ZwClose
ExGetPreviousMode
_stricmp
ZwCreateFile
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwReadFile
ProbeForRead
ZwQuerySystemInformation
ZwCreateKey
swprintf
RtlWriteRegistryValue
RtlCreateRegistryKey
ZwDeleteKey
ZwOpenKey
ZwDeleteValueKey
ZwEnumerateValueKey
ZwQueryKey
wcsstr
_wcslwr
ZwEnumerateKey
CmRegisterCallback
CmUnRegisterCallback
KeQuerySystemTime
PsCreateSystemThread
KeTickCount
KeBugCheckEx
ZwWriteFile
ObfDereferenceObject
RtlUnwind
hal
KeGetCurrentIrql
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ