f:\mydocu~1\work\lurker\sys\objfre_wxp_x86\i386\opengl.pdb
Static task
static1
1 signatures
General
-
Target
ced5d8d39b1ec5943ab588b837aee196_JaffaCakes118
-
Size
16KB
-
MD5
ced5d8d39b1ec5943ab588b837aee196
-
SHA1
80f6f0fe5fcb5f6afc6808a27bf17e6c1c48b70e
-
SHA256
039b608cb40fd1f7ae1e1a3c86f3783d9a1601c359f8328ac6e0df732547c9c7
-
SHA512
1b6286656830951e606f4517734764bad15722845deeb5c39efda1b449010dc714bd2d3e07aa18a0655f067b3df4b6f7b61e7829ca41f6b653579800a2337829
-
SSDEEP
384:BPdwclolZigmNIt7YLJQWZ1/vP7KnkqdmWx8CrW:7wD7FmNGYLJJn7WdiC
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ced5d8d39b1ec5943ab588b837aee196_JaffaCakes118
Files
-
ced5d8d39b1ec5943ab588b837aee196_JaffaCakes118.sys windows:5 windows x86 arch:x86
63826302a7c8c2561032236625dece9e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_wcsnicmp
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwWriteFile
ZwClose
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
ExAllocatePoolWithTag
ObQueryNameString
ObfDereferenceObject
ExFreePoolWithTag
RtlVolumeDeviceToDosName
RtlCompareUnicodeString
ObReferenceObjectByHandle
ZwSetValueKey
wcscat
wcsncat
wcscpy
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
RtlDeleteRegistryValue
ZwCreateKey
KeServiceDescriptorTable
ZwQuerySystemInformation
_stricmp
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
MmUnmapLockedPages
ZwCreateSection
ZwQueryDirectoryFile
MmMapLockedPages
MmBuildMdlForNonPagedPool
MmCreateMdl
IoCreateDevice
IoCreateSymbolicLink
ZwReadFile
ZwSetInformationFile
KeTickCount
KeBugCheckEx
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 303B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 590B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ