D:\work\work20080319\Driver0406\objfre\i386\acpidisk.pdb
Static task
static1
1 signatures
General
-
Target
a43c1d0d8935677a5481132e95da067e_JaffaCakes118
-
Size
168KB
-
MD5
a43c1d0d8935677a5481132e95da067e
-
SHA1
75dd0df2bcf65ffec2a27194cf24fc42ebb3d7ac
-
SHA256
0304cda1b64b5e9e25bf83e07db3daa335c50d0a7c809e566debbaa71f521334
-
SHA512
7aa75e3855aa8d3ad1a5db7dd5bb8c64a20f69f53ed39dedb9ef42fa7e6e4f1fcd6c0ca41696b59ea8466a38595f53f399efb5688734f4eb301f5f2e86501ff8
-
SSDEEP
3072:N/zQa5EnunD4CITuYf3PGEHQwKRVd0fOWVCUZSPSxHaVxSFnQtEXXfIYGB:N8kEnunc/TuYf3PGEmoO9qOSNaVyQaGB
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a43c1d0d8935677a5481132e95da067e_JaffaCakes118
Files
-
a43c1d0d8935677a5481132e95da067e_JaffaCakes118.sys windows:5 windows x86 arch:x86
aa92d42755c927ce44320fedafb3eaa9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwClose
ZwQueryInformationFile
ZwOpenFile
RtlInitUnicodeString
wcscpy
ZwQueryValueKey
ZwOpenKey
strncmp
IoGetCurrentProcess
ZwMapViewOfSection
ZwCreateSection
ZwCreateFile
_stricmp
ZwUnmapViewOfSection
IofCompleteRequest
KeSetEvent
_except_handler3
KeClearEvent
IoCreateNotificationEvent
ObfDereferenceObject
PsLookupProcessByProcessId
ZwWriteFile
wcscat
PsGetVersion
MmGetSystemRoutineAddress
IoDeleteDevice
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
KeWaitForSingleObject
MmUnlockPages
KeInsertQueueApc
KeInitializeApc
KeInitializeEvent
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
ZwAllocateVirtualMemory
ZwOpenProcess
PsTerminateSystemThread
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 541B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ