e:\1\vsproj~1\iofilter\objfre_wnet_x86\i386\iofilter.pdb
Static task
static1
1 signatures
General
-
Target
c1494971a315a822bc5172128ad801c3_JaffaCakes118
-
Size
136KB
-
MD5
c1494971a315a822bc5172128ad801c3
-
SHA1
c61fb500bfe0506d25d3534aa553258804326a1d
-
SHA256
4c07099427a64c869407a17dba8840c09e892dd5148857c4cb970f2af02b6933
-
SHA512
ed7e3f796b8250235b7cbf764661eea7d9f0f531e5a578c59afa80f381e202af3c09dd78bc2104860968330c3e72c22e0cd01e52ccac5c64528b4d4f536344ef
-
SSDEEP
3072:SxAv9VNHt2h2oTBr4V+vnh6G4/nyXt3Jc8xuTz6+VZAhvijG:SevDdt2hhTSVUh4yX+LG
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c1494971a315a822bc5172128ad801c3_JaffaCakes118
Files
-
c1494971a315a822bc5172128ad801c3_JaffaCakes118.sys windows:5 windows x86 arch:x86
3a7b5aaabe00dad91e8c760ebf58e1d0
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
sprintf
_vsnprintf
_vsnwprintf
ZwClose
ZwWriteFile
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
KeQuerySystemTime
_alldiv
KeDelayExecutionThread
rand
srand
ZwSetInformationFile
NtLockFile
ZwOpenFile
ZwOpenKey
ZwQueryValueKey
ZwSetValueKey
ZwDeleteKey
IoFreeMdl
MmUnlockPages
IofCompleteRequest
memmove
ZwEnumerateKey
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
ZwCreateKey
RtlAppendUnicodeToString
RtlCompareMemory
_strnicmp
MmProbeAndLockPages
IoAllocateMdl
MmMapLockedPages
_except_handler3
ObReferenceObjectByHandle
ObReferenceObjectByName
IoDriverObjectType
PsCreateSystemThread
KeTickCount
KeBugCheckEx
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ