D:\zzz\objfre_w2K_x86\i386\zzz.pdb
Static task
static1
1 signatures
General
-
Target
ae47808268c019905b5ad181cfcb75d7_JaffaCakes118
-
Size
10KB
-
MD5
ae47808268c019905b5ad181cfcb75d7
-
SHA1
4f6615e33d47992f31ae0a258dbf1dc9abbe5a49
-
SHA256
38b74ff479655236871fe7d3011f6323c64884a172ce72c1cdf36a2eb382c63c
-
SHA512
89a894a567e86e541843681d4ef0b4e3d0454937f199ac814cc8c089a09705bce025f7b09e7b4db1beca957515fd1469653f64ef82a8074da91fc4600d6750eb
-
SSDEEP
192:BBFB5J58t3cZIojHwn6H3stf0mbf5SD8Vr6GNmfZ7m47YBtjp5kpyvhy00:BBFB5J58eZIots+8xSD8Vrka47mp5kp2
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae47808268c019905b5ad181cfcb75d7_JaffaCakes118
Files
-
ae47808268c019905b5ad181cfcb75d7_JaffaCakes118.sys windows:5 windows x86 arch:x86
2bab89b64be86afecb6e6ba415f1f98e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeSetEvent
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlInitUnicodeString
IoGetConfigurationInformation
IoGetDeviceObjectPointer
IoFreeIrp
IoFreeMdl
MmUnlockPages
IofCallDriver
KeGetCurrentThread
MmProbeAndLockPages
ExFreePool
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
ExAllocatePoolWithTag
_except_handler3
KeWaitForSingleObject
ZwClose
IoDeleteSymbolicLink
IofCompleteRequest
ExfInterlockedInsertTailList
_alldiv
_allshl
_allshr
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ObReferenceObjectByHandle
PsCreateSystemThread
KeInitializeSpinLock
IoCreateSymbolicLink
IoCreateDevice
ZwMakeTemporaryObject
ZwCreateDirectoryObject
ObfDereferenceObject
IoDeleteDevice
hal
KeGetCurrentIrql
KeStallExecutionProcessor
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 388B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 380B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ