e:\winddk\3790.1830\bin\i386\K360.pdb
Static task
static1
General
-
Target
a92038229d71d1782afb306a94e258c9_JaffaCakes118
-
Size
31KB
-
MD5
a92038229d71d1782afb306a94e258c9
-
SHA1
d07c619fb23808561c0c5de3750170990a726f08
-
SHA256
95bfac091ba5d085455b88849ff44127c5fad6b2aaf12dd9b9950109afe26e0a
-
SHA512
1576608a544df682ccdeb7803914b3188be9bfffcdbc18b9ba97687abe7345faac74be593ca2784b47b4c993e207195fb9e6f4636ff334b8154a0a91d18f1030
-
SSDEEP
384:wNVpM7e3GYlDX3D9BkY3jg4gUcwJd99AC7x4QyocjXn8+GSDxKa+rjHBMHQxL:wKi2cJBd3U1Et9jI7jX8+GSDCHGA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a92038229d71d1782afb306a94e258c9_JaffaCakes118
Files
-
a92038229d71d1782afb306a94e258c9_JaffaCakes118.sys windows:5 windows x86 arch:x86
2a19b0edd8d1ac2f97b380ff4bfb7862
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
PsLookupProcessByProcessId
ExFreePoolWithTag
MmUnmapViewOfSection
RtlCompareUnicodeString
NtQuerySystemInformation
ExAllocatePoolWithTag
RtlInitUnicodeString
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 154B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 482B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 408B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ