c:\download\fu_rootkit\exe\i386\msdirectx.pdb
Static task
static1
General
-
Target
eab0aa2aba48bd503c359424aceb523a_JaffaCakes118
-
Size
5KB
-
MD5
eab0aa2aba48bd503c359424aceb523a
-
SHA1
fe5627ae76500da6c2a0db97551501d8a14ff3a7
-
SHA256
7ce8282da7fd814381348a2769e0662193567145a8cd776e7e3a4071aed3c400
-
SHA512
2420902121e963e50d8c19bd35c62e7b31dd5341981819a5295da241a08a2cc72bf7e39345889327a2ee8f120931ea9cb790038404582a96c11c30bb28ec9687
-
SSDEEP
96:z6dN2MumRbVz+baVP0ncPqVZsq6m2dw9TJ:DmRbVab2JqVKqX2dw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource eab0aa2aba48bd503c359424aceb523a_JaffaCakes118
Files
-
eab0aa2aba48bd503c359424aceb523a_JaffaCakes118.sys windows:6 windows x86 arch:x86
8199ec720a4c41ca26ed77b8afdfd1bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
strncmp
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoGetCurrentProcess
ExFreePoolWithTag
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlAnsiStringToUnicodeString
_snprintf
PsGetCurrentProcessId
DbgPrint
ExAllocatePool
memcpy
memset
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 258B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 52B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 640B - Virtual size: 566B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 214B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ