mcd.pdb
Static task
static1
1 signatures
General
-
Target
db0743428072feae3b1e3b7369eeb4b3_JaffaCakes118
-
Size
22KB
-
MD5
db0743428072feae3b1e3b7369eeb4b3
-
SHA1
350eaf4573acebd940f0838adcb4e8662c2330a1
-
SHA256
98288a2748c7aa4bfda6ea97960d274ddd7e29a65e2c509165c9adfd13c06f1c
-
SHA512
e2ef26cd9896423cee6508616e06ed1e0e52380fc41e6838183cbe180b0ba16d8dbcf44354260a41c0e32c1eb508c0f5d96d14026be88c4697ad102d9356370f
-
SSDEEP
384:lKpXhYfnqTyctX4WZCJwWx//uFsH8yCNymn0Qv58E7J/L2x8PL9wtAw+4WZCJwW:EpKfqycVvChcqQv5ZJ/Ly8PL9FrvC
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource db0743428072feae3b1e3b7369eeb4b3_JaffaCakes118
Files
-
db0743428072feae3b1e3b7369eeb4b3_JaffaCakes118.sys windows:5 windows x86 arch:x86
04955ab464ccedc23330b7ab50bca5f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
sprintf
KeInitializeEvent
IofCallDriver
KeWaitForSingleObject
IoGetAttachedDeviceReference
IoAttachDeviceToDeviceStack
ObfDereferenceObject
IoDeleteDevice
IoCreateSymbolicLink
IoAllocateDriverObjectExtension
RtlFreeUnicodeString
swprintf
IoDeleteSymbolicLink
RtlInitUnicodeString
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ExAllocatePoolWithTag
ExFreePoolWithTag
IoGetConfigurationInformation
IoSetHardErrorOrVerifyDevice
IoBuildDeviceIoControlRequest
IoGetDriverObjectExtension
hal
KeGetCurrentIrql
classpnp.sys
ClassClaimDevice
ClassCreateDeviceObject
ClassInitialize
ClassDeleteSrbLookasideList
ClassInitializeSrbLookasideList
ClassGetDescriptor
ClassInitializeMediaChangeDetection
ClassSendSrbSynchronous
ClassUpdateInformationInRegistry
ClassSetMediaChangeState
ClassDisableMediaChangeDetection
ClassDeviceControl
ClassEnableMediaChangeDetection
ClassReleaseRemoveLock
ClassCompleteRequest
ClassWmiCompleteRequest
Exports
Exports
ChangerClassAllocatePool
ChangerClassDebugPrint
ChangerClassFreePool
ChangerClassInitialize
ChangerClassSendSrbSynchronous
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 252B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 88B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 256B - Virtual size: 221B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.qgwu Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 384B - Virtual size: 258B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ