volmgr.pdb
Static task
static1
1 signatures
General
-
Target
0d654ea4514ba6d5e3a1baff0dc158ec_JaffaCakes118
-
Size
52KB
-
MD5
0d654ea4514ba6d5e3a1baff0dc158ec
-
SHA1
6951e98399dda52b0ad30636443e6023b7c297b9
-
SHA256
602ea3c5ea3b7495d9f6583bf880ff11783d7c09de75d6111a836cc4402cfa80
-
SHA512
fab76539a0c1fbed8049a877390df220aee3af3b16539a6786546d068292604e71c34ce5d0b9922bfd9031e6dcfab74b0d7f5e14bd6e04383e01bbeeb2ad0cae
-
SSDEEP
768:T8ZOi6ga2JU+oFJfc9o9+U+xDh33Hmw4jp6oS8CqO+ReG7cxl9PtkU95RudkMm3:T8EBWCJk9a+UKDhHHKjp6oit7uU958C
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0d654ea4514ba6d5e3a1baff0dc158ec_JaffaCakes118
Files
-
0d654ea4514ba6d5e3a1baff0dc158ec_JaffaCakes118.sys windows:6 windows x86 arch:x86
633e41f3024f9c39d7a3bd16677b7765
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePoolWithTag
IoGetAttachedDeviceReference
memcpy
IoReportTargetDeviceChangeAsynchronous
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
ZwClose
ZwFlushKey
ZwOpenKey
RtlQueryRegistryValues
memset
RtlWriteRegistryValue
RtlDeleteRegistryValue
memmove
IoForwardIrpSynchronously
IoInvalidateDeviceRelations
RtlInitUnicodeString
IoOpenDeviceRegistryKey
RtlValidSecurityDescriptor
ObSetSecurityObjectByPointer
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlGetVersion
IoGetDeviceProperty
RtlSubAuthoritySid
RtlInitializeSid
IoGetDeviceObjectPointer
MmPageEntireDriver
MmResetDriverPaging
KeReleaseSemaphore
IoUnregisterPlugPlayNotification
IoRegisterPlugPlayNotification
IoRegisterLastChanceShutdownNotification
RtlCopyUnicodeString
IoDetachDevice
KeInitializeSemaphore
ObfDereferenceObject
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ExQueueWorkItem
IoSetHardErrorOrVerifyDevice
IoInvalidateDeviceState
KeSetEvent
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
PoSetPowerState
PoCallDriver
PoStartNextPowerIrp
IoGetBootDiskInformationLite
RtlCheckRegistryKey
RtlFreeUnicodeString
IoGetDeviceInterfaces
IoWMIRegistrationControl
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfReferenceObject
IoFreeIrp
IoFreeMdl
IoBuildPartialMdl
IoAllocateMdl
IoMakeAssociatedIrp
RtlCompareMemory
IoSetDevicePropertyData
IoGetDevicePropertyData
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
IoUnregisterShutdownNotification
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
IoReportDetectedDevice
ZwQueryValueKey
KeTickCount
KeBugCheckEx
RtlUnwind
KeInitializeEvent
IoBuildDeviceIoControlRequest
IofCallDriver
KeWaitForSingleObject
IoDeleteDevice
_vsnwprintf
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ