c:\winddk\bingdu\i386\RESSDT.pdb
Static task
static1
General
-
Target
fad799977036db6ff546f7173465bbec_JaffaCakes118
-
Size
2KB
-
MD5
fad799977036db6ff546f7173465bbec
-
SHA1
e1614cd130017abf13948834d68a31f9df868b2a
-
SHA256
7559f66d63ac067b8e724486daad3902a39160d0d98fce5e9595d383a98a2b41
-
SHA512
cb65822b59a10e89fff48dbef426c1efa5d9c582492b1ffdf140a82b4f201328305efb233e639cb5a396a45243d13e0d8689323dea4670b8e5f1ff164dc0c2bc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fad799977036db6ff546f7173465bbec_JaffaCakes118
Files
-
fad799977036db6ff546f7173465bbec_JaffaCakes118.sys windows:6 windows x86 arch:x86
c272e51b85a97b9bbea2b8fd23e81412
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoDeleteDevice
KeServiceDescriptorTable
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
KeTickCount
IofCompleteRequest
Sections
.text Size: 384B - Virtual size: 312B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128B - Virtual size: 117B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 384B - Virtual size: 314B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 128B - Virtual size: 62B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ