e:\项目开发\ddk\ange\bin\i386\aNgE.pdb
Static task
static1
General
-
Target
bee89a163711289d31751d9c1ab5d125_JaffaCakes118
-
Size
197KB
-
MD5
bee89a163711289d31751d9c1ab5d125
-
SHA1
540e2baac24fb1a9b786422ddfe49f4337d78af5
-
SHA256
f7469071ebbb29f77e8accc1fd71b3e5f1a3b5d77aebb7ade4440655c4231953
-
SHA512
6bad11b3aeb92f6ea09b1f7bea87de4fa5def7bdbdb56f4239b8b35f4c5e7de7f8556998ec8574fb78e1b47bdf5fdb7e040f6b1f6fc8088c40fabe15d2e14383
-
SSDEEP
1536:BOrH1QV0kgaRn/HyOlGmanr+5AvxCDC72iIgXELQpnnqwsOU9GkBhdO7h4aDJr:Bem0kgkn/HUPr+Gs/iIgOqqlOUtBhAJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bee89a163711289d31751d9c1ab5d125_JaffaCakes118
Files
-
bee89a163711289d31751d9c1ab5d125_JaffaCakes118.sys windows:5 windows x86 arch:x86
91b30a38926952dc57d7239e0a65c905
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateDevice
KeTickCount
RtlEqualUnicodeString
IoCreateSymbolicLink
IofCompleteRequest
hal
KfLowerIrql
KeRaiseIrqlToDpcLevel
Sections
.text Size: 896B - Virtual size: 774B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 159B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 20B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 444B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 118B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ