d:\0713gh0st\server\sys\i386\RESSDT.pdb
Static task
static1
General
-
Target
b870aebcdd1ebeb9118f6374c7c234b7_JaffaCakes118
-
Size
2KB
-
MD5
b870aebcdd1ebeb9118f6374c7c234b7
-
SHA1
ceca5764bc9ced82a3ab4203088fb698b37c9fd9
-
SHA256
0be84eb1dc3240570d89e7c38fee1d53a816707478f706f4b14312cf5a074e60
-
SHA512
db797709d7c8faeceac72da1caf6bd100004347d5d4214c2330c0364a233a71989647bcd2e4d2bc4cee8b514c92c05df7cddef1b631cc072086153e0b8784e3d
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b870aebcdd1ebeb9118f6374c7c234b7_JaffaCakes118
Files
-
b870aebcdd1ebeb9118f6374c7c234b7_JaffaCakes118.sys windows:5 windows x86 arch:x86
1e305bdb6c7b3f884bc2ae45c280d5b8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
Sections
.text Size: 384B - Virtual size: 359B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 140B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 338B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 76B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ