e:\0soft_v03\loader\rootkit\v1.0\driver\objfre_wxp_x86\i386\drive4.pdb
Static task
static1
General
-
Target
dfdc063f55ce36dc5206f01c3a935803_JaffaCakes118
-
Size
29KB
-
MD5
dfdc063f55ce36dc5206f01c3a935803
-
SHA1
3999fcdb739fd05beb727b843ba9920d5591aa82
-
SHA256
0b507f453e0c9807bc522a938c7ad3738f8b0d385b9c8306d1e3fd28aacfd508
-
SHA512
67de2e176a977931f797da1ae7d05b0900ff2f11e2b780cbfdad52f096fd0192bcff0977fa51044dbbb7ce92700c98ce562710d2393ea1f0e48ffd1a98f83e47
-
SSDEEP
384:iU5Y8u6A86nROIz7s3hoCdBgK1P2mRELTlJVY5gsHPOvIkEM3CkpcXmp3T:iUo6X6ROA7sRpP1mhg55mwjXmBT
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dfdc063f55ce36dc5206f01c3a935803_JaffaCakes118
Files
-
dfdc063f55ce36dc5206f01c3a935803_JaffaCakes118.sys windows:6 windows x86 arch:x86
ec20f270a090e100eaf3eec2b63a17ee
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
IoDeleteSymbolicLink
NtBuildNumber
PsLookupProcessByProcessId
PsTerminateSystemThread
KeCancelTimer
KeWaitForSingleObject
KeSetTimerEx
KeInitializeTimerEx
IofCompleteRequest
ZwOpenFile
ExFreePoolWithTag
RtlInitUnicodeString
ExAllocatePool
memcpy
memset
wcsncpy
ZwWriteFile
ZwCreateFile
ZwDeleteFile
DbgPrint
_except_handler3
PsCreateSystemThread
IoCreateSymbolicLink
IoCreateDevice
ZwQuerySystemInformation
ObReferenceObjectByHandle
ZwOpenThread
ObfReferenceObject
ObfDereferenceObject
KeUnstackDetachProcess
MmUnmapLockedPages
IoFreeMdl
KeInsertQueueApc
KeInitializeApc
MmMapLockedPagesSpecifyCache
MmProbeAndLockPages
IoAllocateMdl
wcsncmp
ObOpenObjectByName
wcsstr
KeStackAttachProcess
ZwClose
hal
KfLowerIrql
KfRaiseIrql
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 460B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ