c:\DirectDiskForWin32\KillProcess\objfre_wxp_x86\i386\pcidump.pdb
Static task
static1
1 signatures
General
-
Target
c233d72ae5861d15f918057354e7c285_JaffaCakes118
-
Size
5KB
-
MD5
c233d72ae5861d15f918057354e7c285
-
SHA1
e2b4b3dedc6974843c96f5c9a2a0470f984c7653
-
SHA256
0dec463967a15d4b3cde38c1c6655a49fc41db74f3c00b5907544834a05ddc69
-
SHA512
b6a872ecaa893da8d7f5fda6ceb7389f72180065f787e1556e8136533620d114e258ae7e8d38fa0856b77766071ea66d7b2801af00d809fa24bb02c215118178
-
SSDEEP
96:uqGrVf4WsMizWeFu0zbsBJBjvo1qT5kmuY:AcHK
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c233d72ae5861d15f918057354e7c285_JaffaCakes118
Files
-
c233d72ae5861d15f918057354e7c285_JaffaCakes118.sys windows:5 windows x86 arch:x86
b5303f5b110f01eae09285011dcc5125
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
DbgPrint
PsTerminateSystemThread
ExAllocatePoolWithTag
MmIsAddressValid
ObfDereferenceObject
strncmp
IoGetCurrentProcess
strncpy
KeWaitForSingleObject
MmGetSystemRoutineAddress
PsCreateSystemThread
PsGetCurrentProcessId
PsLookupProcessByProcessId
KeInitializeSpinLock
ObReferenceObjectByName
IoDriverObjectType
IoCreateSymbolicLink
IoCreateDevice
RtlCopyUnicodeString
RtlInitUnicodeString
IoDeleteSymbolicLink
IoDeleteDevice
ExFreePoolWithTag
ObReferenceObjectByHandle
IofCompleteRequest
hal
KfReleaseSpinLock
KeGetCurrentIrql
KfRaiseIrql
KfAcquireSpinLock
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 246B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 896B - Virtual size: 832B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 384B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ