__MmGetPhysicalMemoryRanges@0
___MmRemovePhysicalMemory@0
Static task
static1
Target
ab1f51b248e525526cf55dce83b7903a_JaffaCakes118
Size
32KB
MD5
ab1f51b248e525526cf55dce83b7903a
SHA1
a89f8349cf1db29fd83119eba3c25593eca8da44
SHA256
aa6b16ed68c3c4318060c4147794f86a9468e552cba8e36bb3b9744a288baf09
SHA512
b069a5edb3a107199ec2335c65a75beaf5fa1d9bcaa6309c6075cc8181221942ee1b6fab95fe51b0028cba413e2f13018d78a771c63783611582366d5f7895a3
SSDEEP
384:+2+3OI5LdSs/UJD8yvnJlX8KgLcQumUOeiADYdAenOxFx1BBSIr+ZB7aLk4:j85JSs/3yRlRevx8YjnOx/1BFU7aLT
Checks for missing Authenticode signature.
resource |
---|
ab1f51b248e525526cf55dce83b7903a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
ExFreePoolWithTag
ExAllocatePool
KeGetCurrentThread
PsSetCreateProcessNotifyRoutine
SeSinglePrivilegeCheck
ZwDisplayString
IoAttachDeviceByPointer
KeCancelTimer
ZwCreateTimer
IoGetDeviceObjectPointer
ZwSetInformationThread
IoRaiseHardError
IoReportResourceForDetection
KeWaitForSingleObject
KeSetTimer
wcsncmp
RtlCreateRegistryKey
RtlDeleteRegistryValue
KeInitializeDpc
_wcsnicmp
KeInitializeTimer
_strnicmp
RtlInitUnicodeString
RtlDeleteNoSplay
RtlAnsiStringToUnicodeString
_allmul
memset
MmRemovePhysicalMemory
MmGetPhysicalMemoryRanges
MmGetPhysicalAddress
__MmGetPhysicalMemoryRanges@0
___MmRemovePhysicalMemory@0
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ