mouclass.pdb
Static task
static1
1 signatures
General
-
Target
10ef8b29f67e7debd6aa8785bdf1eaf3_JaffaCakes118
-
Size
23KB
-
MD5
10ef8b29f67e7debd6aa8785bdf1eaf3
-
SHA1
6cad074b91ae2cff27733b3d5d226c5da5f0942e
-
SHA256
bac6e91038265e2d94ad046eca21efb1e31349d947f4314d4df228f309384399
-
SHA512
3ebefe9a3b00b74bc923f1aa4f4628a1761181b0d430b303a14fa17b3ef47b665d145e92396e064703eb0eb887f3fd1d5f74617c56eb7990e7485b5e215a8c68
-
SSDEEP
384:BOQgJpEw+4F7gCHOweWdTSLVA9AEO3BZq4AutCIXkIWJ80893:BVumwpF7grWd4C0n0C
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 10ef8b29f67e7debd6aa8785bdf1eaf3_JaffaCakes118
Files
-
10ef8b29f67e7debd6aa8785bdf1eaf3_JaffaCakes118.sys windows:5 windows x86 arch:x86
ae47640f17f0271d09fdaeab4b0346d2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoOpenDeviceRegistryKey
IoReleaseRemoveLockEx
IofCompleteRequest
IoReleaseCancelSpinLock
IoAcquireRemoveLockEx
KeSetEvent
KeWaitForSingleObject
KeInitializeEvent
memmove
RtlCopyUnicodeString
RtlQueryRegistryValues
RtlAppendUnicodeToString
ObfDereferenceObject
IoRegisterPlugPlayNotification
IoGetDeviceObjectPointer
IoGetDeviceProperty
IoBuildDeviceIoControlRequest
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IoUnregisterPlugPlayNotification
IoFreeWorkItem
DbgPrint
IoQueueWorkItem
IoAllocateWorkItem
PoCallDriver
ZwClose
PoSetPowerState
PoRequestPowerIrp
SeSinglePrivilegeCheck
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
PoSetSystemState
IoDeleteDevice
RtlFreeUnicodeString
KeInitializeSpinLock
IoInitializeRemoveLockEx
IoCreateDevice
IoSetDeviceInterfaceState
IoWMIRegistrationControl
IoCancelIrp
ZwSetValueKey
RtlWriteRegistryValue
IoDetachDevice
IoReleaseRemoveLockAndWaitEx
IoRegisterDeviceInterface
IoAttachDeviceToDeviceStack
IoRegisterDriverReinitialization
KeTickCount
KeBugCheckEx
VerSetConditionMask
RtlVerifyVersionInfo
ZwPowerInformation
RtlInitUnicodeString
ExAllocatePoolWithTag
ZwQueryValueKey
ExFreePoolWithTag
PoStartNextPowerIrp
IofCallDriver
hal
KfAcquireSpinLock
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 512B - Virtual size: 417B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 896B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ