redbook.pdb
Static task
static1
1 signatures
General
-
Target
ef7c007a83cb43de57922c26381637f6_JaffaCakes118
-
Size
56KB
-
MD5
ef7c007a83cb43de57922c26381637f6
-
SHA1
01bfa27b05eaabc2c6138633c91938b358cf3738
-
SHA256
06dff811c20ad619fc69fd8b3486242aedcc7cc3a4c0deda78a560af7381681c
-
SHA512
ca79d449a077a8eba627168a2d0e3ac08316f39aee358a55e7e0b9d5db7c3a38cfc9558819070729f5e256c50b7aed62468889d984776ae4bb8c9f9e06656405
-
SSDEEP
768:LvM9HDkL0716NBg4bI8kyZN5GeLuAtbwGf+MhVxcs8Km5keq2ZX2PTYnGNWBcqwq:TNXtNvq5Y0qtoKTITYCGry6
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ef7c007a83cb43de57922c26381637f6_JaffaCakes118
Files
-
ef7c007a83cb43de57922c26381637f6_JaffaCakes118.sys windows:5 windows x86 arch:x86
f60ea72a595b25ed2508cd0ace948e2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
IoGetDeviceInterfaces
wcslen
WmiQueryTraceInformation
IoWMIRegistrationControl
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoGetDriverObjectExtension
IoAllocateDriverObjectExtension
IofCallDriver
IoDeleteDevice
IoDetachDevice
PsCreateSystemThread
KeInitializeSpinLock
IoInitializeRemoveLockEx
KeInitializeEvent
IoAttachDeviceToDeviceStack
IoCreateDevice
IoReleaseRemoveLockEx
KeSetEvent
KeWaitForSingleObject
IofCompleteRequest
IoAcquireRemoveLockEx
IoUnregisterPlugPlayNotification
IoReleaseRemoveLockAndWaitEx
IoRegisterPlugPlayNotification
ExfInterlockedInsertTailList
ZwCreateFile
ExfInterlockedRemoveHeadList
KeQueryTimeIncrement
KeTickCount
KeWaitForMultipleObjects
KeSetPriorityThread
KeGetCurrentThread
_alldiv
_allmul
IoReuseIrp
IoFreeMdl
IoFreeIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
KeClearEvent
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
ZwOpenKey
IoOpenDeviceRegistryKey
RtlWriteRegistryValue
ZwCreateKey
_aulldiv
PoCallDriver
PoStartNextPowerIrp
IoInitializeIrp
KeBugCheckEx
ExFreePoolWithTag
ObReferenceObjectByHandle
ZwClose
ObfDereferenceObject
IoGetRelatedDeviceObject
WmiTraceMessage
IoAllocateErrorLogEntry
PsTerminateSystemThread
IoWriteErrorLogEntry
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiCompleteRequest
WmiSystemControl
ks.sys
KsCreatePin
KsSynchronousIoControlDevice
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGERW Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGECONS Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ