tdpipe.pdb
Static task
static1
1 signatures
General
-
Target
bac547b60427d9812e0207e1920109df_JaffaCakes118
-
Size
22KB
-
MD5
bac547b60427d9812e0207e1920109df
-
SHA1
b255a98188a4a3d4303833f879cd2d34b69e90f8
-
SHA256
2760698b5c0904e67fea2a978b2bca9c6585a49e0ddfe2a69ea378b900866aca
-
SHA512
e69e74a24f81c9385dba032c9501ba6158ff6d7d2994c4c68b567d90473e3e229ad274c942f1e0fb3f0edd7621d6f8b19ad8931eb002a2707a14a1ee63a5dca6
-
SSDEEP
384:h7XsVqjEbIS61MM7+eQGhaWG8nIWCFX4es2ApORShH0HsK3OceOGOZRVRfX0WKWO:hIAjOId7+RmnqowUOcUMRcTXNX5/nqJ
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bac547b60427d9812e0207e1920109df_JaffaCakes118
Files
-
bac547b60427d9812e0207e1920109df_JaffaCakes118.sys windows:5 windows x86 arch:x86
be34ffb3683edbc99c5b6becf288cad2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeTickCount
ZwCreateFile
ZwFsControlFile
IoFileObjectType
ObReferenceObjectByPointer
IoGetCurrentProcess
IoGetRelatedDeviceObject
ObfDereferenceObject
ZwClose
wcslen
IofCallDriver
MmBuildMdlForNonPagedPool
_except_handler3
IoDeleteDevice
IofCompleteRequest
IoCreateDevice
RtlInitUnicodeString
wcscat
wcscpy
KeInitializeEvent
KeInitializeSpinLock
DbgPrint
KeGetCurrentThread
KeResetEvent
KeSetEvent
IoFreeMdl
MmUnlockPages
IoSetCompletionRoutineEx
IoInitializeIrp
MmSizeOfMdl
IoCancelIrp
KeClearEvent
ObfReferenceObject
ExfInterlockedInsertTailList
NtSetInformationThread
MmIsNonPagedSystemAddressValid
IoCreateFile
ObReferenceObjectByHandle
termdd.sys
IcaRawInput
IcaChannelInput
IcaBufferFree
IcaBufferError
IcaCreateThread
IcaAllocateWorkItem
IcaQueueWorkItemEx
IcaStackAllocatePool
IcaCloseHandle
IcaCreateHandle
IcaStackFreePool
IcaWaitForSingleObject
IcaStackAllocatePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ajry Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ