d:\programs\siberia2\protect\objfre_wxp_x86\i386\protect.pdb
Static task
static1
General
-
Target
e22ed735ddc11c7b1dfa085e12765a45_JaffaCakes118
-
Size
30KB
-
MD5
e22ed735ddc11c7b1dfa085e12765a45
-
SHA1
aa67ab3b6a8107e085317f0c3c0c41f13b49fff7
-
SHA256
fc7c79b7625658440ee9c8b5c30be247e79fbaf5c84aa02a271ae4c662abb6ae
-
SHA512
f29f9b9a5c61afa68a5c9d3a004d22b0a1c318133c758933756fde651e9ff5c9a951f6c909643ee9b51e425ed0eeeb51ffe50bbcee415697cc35255a7c1ae99a
-
SSDEEP
384:HFcXSOwytyVCizMK7MEiZt8U/g9agCi1apw/vQaShMQOzXcsMyllNvr4X4Kn6RDj:4VgM3Lv0x4+/shmzNlJ4X4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource e22ed735ddc11c7b1dfa085e12765a45_JaffaCakes118
Files
-
e22ed735ddc11c7b1dfa085e12765a45_JaffaCakes118.sys windows:6 windows x86 arch:x86
fd056cefb51e16931d199a85a9f02eec
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
memcpy
strcmp
ExFreePoolWithTag
ExAllocatePoolWithTag
ZwQuerySystemInformation
memset
Sections
.text Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 256B - Virtual size: 145B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 256B - Virtual size: 184B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ