ipsec.pdb
Static task
static1
1 signatures
General
-
Target
b2b0b8df6d49ec70ef3346d676ec2c9f_JaffaCakes118
-
Size
73KB
-
MD5
b2b0b8df6d49ec70ef3346d676ec2c9f
-
SHA1
af1381930949c582f0d9fe9fe8040ae1be4b71cc
-
SHA256
124ed9134924239b8640902f4cf7bbe453bf7722e492757e68cfb17294e339e2
-
SHA512
253366f9fb83a600d461ce29ab0fc9d48b7339bed2cc3742eea3dc4cb07ff3b608726e51bad7a33808e6149edbe79c75854f2eba6e1e782eb1a881173e3462b1
-
SSDEEP
768:SOFn+koR1/KUJbxoki0pRsgFfin8x4Bu+7tstQACXn4RIcF55Sv1dw7MVRW44cfp:fnSRq5GbE8x4BZstQiFuuMe4f4
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b2b0b8df6d49ec70ef3346d676ec2c9f_JaffaCakes118
Files
-
b2b0b8df6d49ec70ef3346d676ec2c9f_JaffaCakes118.sys windows:5 windows x86 arch:x86
3b838288bb06dd95d5d887532fb636c6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
hal
KfAcquireSpinLock
KfReleaseSpinLock
KfLowerIrql
ndis.sys
NdisCancelTimer
NdisWriteEventLogEntry
NdisSetTimer
NdisInitializeTimer
ntoskrnl.exe
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoGetDeviceObjectPointer
IofCompleteRequest
KeQuerySystemTime
RtlExtendedIntegerMultiply
ZwClose
MmIsThisAnNtAsSystem
ExInitializeNPagedLookasideList
IoDeleteDevice
IoDeleteSymbolicLink
KeDelayExecutionThread
IoAcquireCancelSpinLock
IoCreateSymbolicLink
IoCreateDevice
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
ObfDereferenceObject
RtlAnsiStringToUnicodeString
RtlIntegerToUnicodeString
IoReleaseCancelSpinLock
KeTickCount
KeBugCheckEx
wcslen
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
MmBuildMdlForNonPagedPool
MmSizeOfMdl
ExDeleteNPagedLookasideList
KeInitializeSpinLock
ExAllocatePoolWithTag
ExFreePoolWithTag
ZwQueryValueKey
RtlInitUnicodeString
ZwOpenKey
InterlockedPushEntrySList
memmove
ExQueueWorkItem
_allshl
MmMapLockedPagesSpecifyCache
ExInitializeResourceLite
ExDeleteResourceLite
ZwDeviceIoControlFile
ZwLoadDriver
ZwCreateFile
RtlSplay
RtlDelete
KeCancelTimer
_alldiv
KeSetTimerEx
KeInitializeTimer
KeInitializeDpc
KeQueryTimeIncrement
ExInterlockedAddLargeStatistic
InterlockedPopEntrySList
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ