E:\work_other\hintNdisHook\Bin\i386\hintKnh.pdb
Static task
static1
1 signatures
General
-
Target
d1e5cf105edbffc182224e291e4098a2_JaffaCakes118
-
Size
73KB
-
MD5
d1e5cf105edbffc182224e291e4098a2
-
SHA1
8a0613ccf35895b94a9f1f42b5e496a0425d54fa
-
SHA256
13f440b60202b54278218be08cd7a3976c52d777599de9d9cfba6f3813b74f5b
-
SHA512
cf778953fc57547a39d468b5053e56b59bea35509b2ce8b957853155ead6785591a5f4f73653e9388096f51b0c900dde1ef5617b16879fb01bb3b59d4501fcbe
-
SSDEEP
1536:hVriXSN6lbiMgyokIVxkSJ/Wr0gzYHnM:h4NlbiBk6pwzYs
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1e5cf105edbffc182224e291e4098a2_JaffaCakes118
Files
-
d1e5cf105edbffc182224e291e4098a2_JaffaCakes118.sys windows:5 windows x86 arch:x86
c2108b89338f131f49172afdc6a3fd03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeGetCurrentThread
ObReferenceObjectByHandle
ObfDereferenceObject
KdDisableDebugger
KdDebuggerEnabled
PsCreateSystemThread
KeInsertQueueApc
KeInitializeApc
RtlAssert
IoFreeMdl
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
IoAllocateMdl
_strnicmp
strncmp
MmMapLockedPages
memmove
strstr
RtlCompareMemory
KeSetEvent
KeQuerySystemTime
MmIsAddressValid
wcscpy
IofCompleteRequest
wcscat
wcslen
_stricmp
strrchr
ZwQuerySystemInformation
ZwClose
ZwReadFile
ZwCreateFile
ObReferenceObjectByName
IoDriverObjectType
swprintf
mbstowcs
ZwQueryValueKey
wcstombs
ZwOpenKey
MmUnmapLockedPages
ZwOpenFile
InterlockedExchange
MmCreateMdl
KeServiceDescriptorTable
wcsncmp
sprintf
IoDeleteSymbolicLink
_except_handler3
KeDelayExecutionThread
ExFreePool
ExAllocatePoolWithTag
KeInitializeSpinLock
RtlInitUnicodeString
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
KeInitializeEvent
PsGetCurrentProcessId
_vsnprintf
_local_unwind2
DbgPrint
hal
KfAcquireSpinLock
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock
ndis.sys
NdisInitializeString
NdisCompleteBindAdapter
NdisCompleteUnbindAdapter
NdisDeregisterProtocol
NdisFreeMemory
NdisRegisterProtocol
NdisReadConfiguration
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ