D:\QuickEye\qedrv\objfre_wxp_x86\i386\qedrv.pdb
Static task
static1
General
-
Target
c8f0aa0db0c7eb1a4c1477cff20590f4_JaffaCakes118
-
Size
3KB
-
MD5
c8f0aa0db0c7eb1a4c1477cff20590f4
-
SHA1
a61fe9a2983f1fb4d15f3754504b2cd78a987a26
-
SHA256
2f04c63b892ba4d8ed08f7e7cb36cf8fc59cc501710bbc02f102b268cf88c614
-
SHA512
6a24ba6b1a917a1cc8d2a8b97a4be2ff80dd4998b00040a931c32fa15614891e4eebe34693eb15936bcfc9abce0aad7bc417fdaf6e768a1d8c102ace1e665698
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c8f0aa0db0c7eb1a4c1477cff20590f4_JaffaCakes118
Files
-
c8f0aa0db0c7eb1a4c1477cff20590f4_JaffaCakes118.sys windows:5 windows x86 arch:x86
2869fbae356fe2af4713bf53fd8031e9
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ExSystemTimeToLocalTime
KeQuerySystemTime
_aulldiv
IofCompleteRequest
PsSetLoadImageNotifyRoutine
ExFreePoolWithTag
KeInitializeEvent
IoCreateNotificationEvent
IoDeleteDevice
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeSetEvent
PsSetCreateProcessNotifyRoutine
KeClearEvent
hal
ExReleaseFastMutex
ExAcquireFastMutex
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 556B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 118B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ