f:\winddk\hggg\objfre_wxp_x86\i386\HGGG.pdb
Static task
static1
1 signatures
General
-
Target
ae5f655b6178e46ea2584d112249a1ff_JaffaCakes118
-
Size
36KB
-
MD5
ae5f655b6178e46ea2584d112249a1ff
-
SHA1
99a54d44b263621cf9aeec93415b2fe6a2b1a3d9
-
SHA256
9853656a15d891a352081b9d0e76c3931810e2febbfb362af4c5ec0f66e7e0fe
-
SHA512
af2d7f34e5550bc25ee2969d61c8decea3f1f422a91191a2a57c140b3121b5bd1937887b763f88615c78e2e9df882fa8bef68e93c28f0771ccec8e073cb3dd5b
-
SSDEEP
768:XPNszosQpUQRViVJguDCRlhMeefWjQnbcuyD7Uu6MI:f/WQR+guDghpeeQnouy8u6MI
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae5f655b6178e46ea2584d112249a1ff_JaffaCakes118
Files
-
ae5f655b6178e46ea2584d112249a1ff_JaffaCakes118.sys windows:5 windows x86 arch:x86
8612db68eeba68a56df43ab8aa0f4a2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
IoFreeIrp
KeSetEvent
IoFreeMdl
MmUnlockPages
IoDeleteDevice
IoDeleteSymbolicLink
_stricmp
strrchr
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation
ObfDereferenceObject
IoDriverObjectType
ZwClose
ZwReadFile
MmIsAddressValid
IoCreateFile
KeWaitForSingleObject
KeGetCurrentThread
MmProbeAndLockPages
IoAllocateMdl
IoAllocateIrp
KeInitializeEvent
KdDisableDebugger
IofCompleteRequest
ObReferenceObjectByHandle
IoFileObjectType
_allmul
IoCreateSymbolicLink
IoCreateDevice
DbgPrint
KeTickCount
KeBugCheckEx
ZwQueryInformationFile
IoGetCurrentProcess
hal
KeStallExecutionProcessor
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 896B - Virtual size: 812B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 508B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ