c:\users\icyheart\docume~1\visual~2\projects\download\driver\objfre_wxp_x86\i386\Driver.pdb
Static task
static1
1 signatures
General
-
Target
a64ccf22771bab743b99083ad4d6b38b_JaffaCakes118
-
Size
7KB
-
MD5
a64ccf22771bab743b99083ad4d6b38b
-
SHA1
59241ae0cd3584513b3f42535853305075d6440a
-
SHA256
92f6e144dafa635518f2af38c63866eaa0ed61353cf3958777389426a319ee85
-
SHA512
d5b469b2e14106a44bb26451fcaa64fcdddb323d904e5aefe0ae4d44ec5aeb2104c2ce33ddbe60e3bffd6be4518b2c9feda1a905cda9fb797d30f2f51b3e42fc
-
SSDEEP
96:CVc2NKMiL6vIk+PxDZKm0z+YxQTKk2YMdbwq8k:CdviYIkcAgrKZYGl8
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a64ccf22771bab743b99083ad4d6b38b_JaffaCakes118
Files
-
a64ccf22771bab743b99083ad4d6b38b_JaffaCakes118.sys windows:6 windows x86 arch:x86
9d66060bc7f907450d410d924d358b62
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ZwOpenProcess
ZwClose
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
RtlCompareString
RtlInitString
ZwMapViewOfSection
ZwCreateSection
ZwOpenFile
RtlInitUnicodeString
RtlFreeAnsiString
ObfDereferenceObject
RtlUnicodeStringToAnsiString
ObReferenceObjectByPointer
ObReferenceObjectByHandle
memcpy
strchr
KeServiceDescriptorTable
IofCompleteRequest
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 802B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 256B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ