c:\1\DRIVER.pdb
Static task
static1
General
-
Target
b7b47b4c2f1ef5bb3000aa1be1e122f1_JaffaCakes118
-
Size
7KB
-
MD5
b7b47b4c2f1ef5bb3000aa1be1e122f1
-
SHA1
57bb3ee130b9dbb791ed9a36d7a7897ae862b171
-
SHA256
f2da27638f425381b26a6e3d995c6c2bd09024723a88294a2c870eb7b76168b1
-
SHA512
3cf5d536b6957a0fe78b243d7d244bd5624ada75c1107112b170f41dc57a775eaaf05bc278650dc8909ef1f34122ed19bc55a9ffb71ec521344e18f7b311f011
-
SSDEEP
192:a5/iPUen1ptzptQgxZBHnUi2f6/SKQWOsBdm:ax1+TntNxZBHnUn6/SKQl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b7b47b4c2f1ef5bb3000aa1be1e122f1_JaffaCakes118
Files
-
b7b47b4c2f1ef5bb3000aa1be1e122f1_JaffaCakes118.sys windows:5 windows x86 arch:x86
07eb396c6da16042a9d6918d3cbd7ae0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_except_handler3
KeReleaseMutex
_wcsnicmp
wcslen
KeWaitForSingleObject
ExFreePool
wcsncpy
InterlockedExchange
KeServiceDescriptorTable
ExGetPreviousMode
NtBuildNumber
KeInitializeMutex
IoDeleteDevice
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
ProbeForRead
IofCompleteRequest
ExAllocatePoolWithTag
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 768B - Virtual size: 674B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 226B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ