F:\WorkStation\ZongCan\DrvProject\2K\objfre_w2k\i386\HideDriver.pdb
Static task
static1
General
-
Target
b4f89170e461413ddf1c491bc551eccb_JaffaCakes118
-
Size
9KB
-
MD5
b4f89170e461413ddf1c491bc551eccb
-
SHA1
0aa63958407b26c5c2d1d6ea594b8d6b29ced123
-
SHA256
458902f2e4c98575e2c80099aa92fd33434a2d9c75b4dbcb3b76e9df822c95ad
-
SHA512
9dfb048dbbd82ccdc7b0a1ebfe74be167415fd63a02308325302a36c800109eb4f0be1a408caa403561d54ad01e7ded6550d43bff104f73f811eed2ae3e2a7c5
-
SSDEEP
192:EpaQhyQ7pNU7jNwsQisj8ajvUWenBok+5MSMGy9:EImtXWNwsQistenuk+9U
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b4f89170e461413ddf1c491bc551eccb_JaffaCakes118
Files
-
b4f89170e461413ddf1c491bc551eccb_JaffaCakes118.sys windows:5 windows x86 arch:x86
a5a7f853bcbd40d83a6ca05d860ba05c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeServiceDescriptorTable
ExFreePool
ZwQueryDirectoryFile
ZwQueryObject
ExAllocatePoolWithTag
strchr
strstr
RtlFreeAnsiString
RtlUpperString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
ZwDeviceIoControlFile
DbgPrint
ZwEnumerateValueKey
ZwEnumerateKey
RtlCompareUnicodeString
KeGetPreviousMode
IoGetCurrentProcess
strncpy
ProbeForWrite
_strupr
KeEnterCriticalRegion
MmIsAddressValid
KeAddSystemServiceTable
KeLeaveCriticalRegion
_except_handler3
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 384B - Virtual size: 360B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 676B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 518B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ