C:\Glider\Shadow\objfre_wxp_x86\i386\Shadow.pdb
Static task
static1
General
-
Target
ad6fe9f8f6883a769c0292d9c8724d3b_JaffaCakes118
-
Size
3KB
-
MD5
ad6fe9f8f6883a769c0292d9c8724d3b
-
SHA1
b04ac1540380b024c37b45488ab8341f6b2f429c
-
SHA256
3fbdcfa5aca16fd684140660f817dd5cdd5137e2218feb3683509f65139a9a0c
-
SHA512
ddc12c2719d81d6258b3565aea432c0508b4a68eb047e693fb16bbdd2d222fd7605a49e62fa7dcecc6d68b704a3931fe8bcafa7b520bcc6695d4c3f49c4b3861
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ad6fe9f8f6883a769c0292d9c8724d3b_JaffaCakes118
Files
-
ad6fe9f8f6883a769c0292d9c8724d3b_JaffaCakes118.sys windows:5 windows x86 arch:x86
ff3dfca311bc33a410039d03e2b7b12e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
KeGetCurrentThread
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
NtBuildNumber
KeServiceDescriptorTable
ZwQuerySystemInformation
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 338B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ