D:\work\Work081119\Wis080927\objchk\i386\dcpidesk.pdb
Static task
static1
1 signatures
General
-
Target
da8d423d8755c4ec5c2f4ad9e275d4c9_JaffaCakes118
-
Size
143KB
-
MD5
da8d423d8755c4ec5c2f4ad9e275d4c9
-
SHA1
8641ffc7675215ff1446a7368b15852452b14c7e
-
SHA256
80833df5300f9b103e471f09696dbbbe4e261204bdb3d3c3e6184cb5be606e63
-
SHA512
466b5589111a4e3fd37bfbaa4838235873dd3d9c92cdfa5505b2968908fdf402ba8a074c1907a7e6c9330759ad9bcec2a7b4c682db6a67165bd13253afc3d76f
-
SSDEEP
3072:Ee6rqKZnEo3Zpmgj4A1yvgVg+S7OJR6rrF4+kMS:Ee6uKZEKO3v70R63F5S
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da8d423d8755c4ec5c2f4ad9e275d4c9_JaffaCakes118
Files
-
da8d423d8755c4ec5c2f4ad9e275d4c9_JaffaCakes118.sys windows:5 windows x86 arch:x86
ad87f2f71db37e273c6a9ebe01c7f6a2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
_stricmp
IoGetCurrentProcess
IoDeleteDevice
MmGetSystemRoutineAddress
RtlInitUnicodeString
wcscpy
ExFreePoolWithTag
ZwReadFile
ExAllocatePoolWithTag
ZwClose
ZwQueryInformationFile
ZwOpenFile
ZwQueryValueKey
ZwOpenKey
PsCreateSystemThread
ZwWriteFile
ZwCreateFile
wcscat
PsGetVersion
strncmp
ZwMapViewOfSection
ZwCreateSection
ZwUnmapViewOfSection
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
KeWaitForSingleObject
MmUnlockPages
KeInsertQueueApc
KeInitializeApc
KeInitializeEvent
KeUnstackDetachProcess
MmMapLockedPagesSpecifyCache
KeStackAttachProcess
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
_except_handler3
KeSetEvent
ZwAllocateVirtualMemory
KeClearEvent
IoCreateNotificationEvent
ObfDereferenceObject
PsLookupProcessByProcessId
IoCreateDevice
Exports
Exports
?RegDll10@@YGHXZ
?RegDll11@@YGHXZ
?RegDll12@@YGHXZ
?RegDll13@@YGHXZ
?RegDll14@@YGHXZ
?RegDll15@@YGHXZ
?RegDll16@@YGHXZ
?RegDll17@@YGHXZ
?RegDll18@@YGHXZ
?RegDll19@@YGHXZ
?RegDll1@@YGHXZ
?RegDll20@@YGHXZ
?RegDll21@@YGHXZ
?RegDll22@@YGHXZ
?RegDll23@@YGHXZ
?RegDll24@@YGHXZ
?RegDll25@@YGHXZ
?RegDll26@@YGHXZ
?RegDll27@@YGHXZ
?RegDll28@@YGHXZ
?RegDll29@@YGHXZ
?RegDll2@@YGHXZ
?RegDll30@@YGHXZ
?RegDll31@@YGHXZ
?RegDll32@@YGHXZ
?RegDll33@@YGHXZ
?RegDll34@@YGHXZ
?RegDll35@@YGHXZ
?RegDll36@@YGHXZ
?RegDll37@@YGHXZ
?RegDll38@@YGHXZ
?RegDll39@@YGHXZ
?RegDll3@@YGHXZ
?RegDll40@@YGHXZ
?RegDll41@@YGHXZ
?RegDll4@@YGHXZ
?RegDll5@@YGHXZ
?RegDll6@@YGHXZ
?RegDll7@@YGHXZ
?RegDll8@@YGHXZ
?RegDll9@@YGHXZ
?RegDll@@YGHXZ
Sections
.text Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 554B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.edata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 640B - Virtual size: 628B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ