D:\killkb\objfre\i386\killkb.pdb
Static task
static1
General
-
Target
ae84666bd235c23f20d5549cb7f97350_JaffaCakes118
-
Size
2KB
-
MD5
ae84666bd235c23f20d5549cb7f97350
-
SHA1
9cb742598fa0b46999de816329d74ec568b7ed70
-
SHA256
0919de153a2ed6576b805a4f3d27e10e3f098b97a8941aa76f35514566de7240
-
SHA512
22ec91c4bcc6a0e0e08a97dfabb9dc7c79a6b551fbcd3ca89479bfc59b99eba7e94c46d49df796d4040728c18de56017753d1d74c222e99310aba71bba8a0785
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ae84666bd235c23f20d5549cb7f97350_JaffaCakes118
Files
-
ae84666bd235c23f20d5549cb7f97350_JaffaCakes118.sys windows:5 windows x86 arch:x86
94d07a2c5b7927b63da16147d1edd21b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IofCompleteRequest
ZwOpenProcess
ZwClose
ZwTerminateJobObject
ZwAssignProcessToJobObject
ZwCreateJobObject
IoCreateSymbolicLink
IoCreateDevice
Sections
.text Size: 768B - Virtual size: 686B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 133B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 384B - Virtual size: 332B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 72B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ