redbook.pdb
Static task
static1
1 signatures
General
-
Target
04b4d484bfb22eca316581911126e2c1_JaffaCakes118
-
Size
56KB
-
MD5
04b4d484bfb22eca316581911126e2c1
-
SHA1
1531d15c1be0b066fd34d665564ee037abe4fdf7
-
SHA256
c0e7519d3f34177aab30febbce397b6bdf3b0a3f5bc13e442fdcd8393320396e
-
SHA512
7b4d4ae6f8c61d14f7c084812c5529fee9f186df50874760b247fe0ce8b95293656f23a5bf4a2bfd7de5a17b39b77bb0872c9ddd8fd22c14db960c70bcdcf7d6
-
SSDEEP
768:yIDbEntQZ0AxwZuheJ6CuFAqaSeyLkmmK6L2j8R7pk75cfb5K:2ntQZz2dqaStLkmAL2j8Ry65K
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04b4d484bfb22eca316581911126e2c1_JaffaCakes118
Files
-
04b4d484bfb22eca316581911126e2c1_JaffaCakes118.sys windows:5 windows x86 arch:x86
f60ea72a595b25ed2508cd0ace948e2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
IoGetDeviceInterfaces
wcslen
WmiQueryTraceInformation
IoWMIRegistrationControl
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoGetDriverObjectExtension
IoAllocateDriverObjectExtension
IofCallDriver
IoDeleteDevice
IoDetachDevice
PsCreateSystemThread
KeInitializeSpinLock
IoInitializeRemoveLockEx
KeInitializeEvent
IoAttachDeviceToDeviceStack
IoCreateDevice
IoReleaseRemoveLockEx
KeSetEvent
KeWaitForSingleObject
IofCompleteRequest
IoAcquireRemoveLockEx
IoUnregisterPlugPlayNotification
IoReleaseRemoveLockAndWaitEx
IoRegisterPlugPlayNotification
ExfInterlockedInsertTailList
ZwCreateFile
ExfInterlockedRemoveHeadList
KeQueryTimeIncrement
KeTickCount
KeWaitForMultipleObjects
KeSetPriorityThread
KeGetCurrentThread
_alldiv
_allmul
IoReuseIrp
IoFreeMdl
IoFreeIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
KeClearEvent
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
ZwOpenKey
IoOpenDeviceRegistryKey
RtlWriteRegistryValue
ZwCreateKey
_aulldiv
PoCallDriver
PoStartNextPowerIrp
IoInitializeIrp
KeBugCheckEx
ExFreePoolWithTag
ObReferenceObjectByHandle
ZwClose
ObfDereferenceObject
IoGetRelatedDeviceObject
WmiTraceMessage
IoAllocateErrorLogEntry
PsTerminateSystemThread
IoWriteErrorLogEntry
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiCompleteRequest
WmiSystemControl
ks.sys
KsCreatePin
KsSynchronousIoControlDevice
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGERW Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGECONS Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ