D:\VVVVVVVVVVVVVVVVVVVVVVVVVVV.pdb
Static task
static1
1 signatures
General
-
Target
acc80a51c5e92884ea7d556e53ea5c67_JaffaCakes118
-
Size
3KB
-
MD5
acc80a51c5e92884ea7d556e53ea5c67
-
SHA1
85de329161d955862bb0628dd379df40111e5807
-
SHA256
6f53fe17fc02ba30cccddeb872564d1363df32af29a1dda4ea941081b160398b
-
SHA512
cbb9bfe9a28bbc17b7d82154c042050c73ba8e08037a0d85a4654b9c76687cf05ebe76c88f167a8e589eabcc157677214ea92b558012486339446757733e6051
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource acc80a51c5e92884ea7d556e53ea5c67_JaffaCakes118
Files
-
acc80a51c5e92884ea7d556e53ea5c67_JaffaCakes118.sys windows:5 windows x86 arch:x86
2bd2b75d86888bce3d1a38eb6799f5af
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoFreeIrp
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
IofCallDriver
KeGetCurrentThread
KeInitializeEvent
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoFileObjectType
IofCompleteRequest
RtlInitUnicodeString
PsLookupProcessByProcessId
ZwClose
DbgPrint
KeServiceDescriptorTable
ProbeForWrite
ProbeForRead
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
_except_handler3
MmUnmapViewOfSection
IoCreateFile
hal
KeGetCurrentIrql
Sections
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 744B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 144B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ