volsnap.pdb
Static task
static1
1 signatures
General
-
Target
0e545e6727632d7b541dddc62688ac78_JaffaCakes118
-
Size
239KB
-
MD5
0e545e6727632d7b541dddc62688ac78
-
SHA1
8bde0210056f4ce85fad85d35bb614635b99cb5d
-
SHA256
82a460f808a878d4b1875002dc964a6c9daf026e63fe533d738110e00ad26ee5
-
SHA512
26ce86c5bccb8bf8729eba2f9f9fa8a6fa5b4b44c7863c87fba6ce82ac02f70353b5535bc101fe3d95b74e369fb0c6fb0e172462e9cc1ca37733dab1ef71ef9e
-
SSDEEP
6144:t1r0/LRxYFqKXIgiYlKwu0H+XTqmu3iKi8Yzh:t1rKRxERlKV0eXTqbiqg
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e545e6727632d7b541dddc62688ac78_JaffaCakes118
Files
-
0e545e6727632d7b541dddc62688ac78_JaffaCakes118.sys windows:6 windows x86 arch:x86
f3ac9b3d4f01ae5fe6a326219a159f5b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlClearBits
RtlClearBit
RtlSetBits
RtlSetBit
RtlNumberOfSetBits
RtlAreBitsClear
RtlAreBitsSet
RtlFindNextForwardRunClear
memcpy
KeWaitForSingleObject
KeReleaseSemaphore
memset
MmBuildMdlForNonPagedPool
IoSetIoPriorityHint
ExFreePoolWithTag
IoFreeMdl
IoAllocateIrp
IoAllocateMdl
ExAllocatePoolWithTag
IoFreeIrp
RtlCompareMemory
ZwClose
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
RtlQueryRegistryValues
ZwCreateKey
RtlStringFromGUID
ObfDereferenceObject
ExQueueWorkItem
IofCompleteRequest
IofCallDriver
_allshr
KeSetEvent
ZwQueryVolumeInformationFile
ZwFsControlFile
_allmul
_alldiv
ZwQueryInformationFile
ZwSetInformationFile
IoDeleteSymbolicLink
swprintf_s
KeQueryTimeIncrement
KeTickCount
IoGetIoPriorityHint
MmMapLockedPagesSpecifyCache
IoFileObjectType
RtlGetAce
RtlEqualSid
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
ZwQuerySecurityObject
ZwOpenFile
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoReleaseCancelSpinLock
KeResetEvent
IoAcquireCancelSpinLock
RtlAppendUnicodeStringToString
RtlCreateSystemVolumeInformationFolder
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlCreateSecurityDescriptor
ZwReadFile
KeInitializeMutex
KeReleaseMutex
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableAvl
RtlInitializeBitMap
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
MmLockPagableDataSection
MmUnlockPages
ZwUnmapViewOfSection
RtlDeleteElementGenericTableAvl
ObfReferenceObject
RtlEqualUnicodeString
ObReferenceObjectByHandle
RtlGetVersion
_allrem
IoGetDeviceObjectPointer
ZwSetValueKey
PsGetThreadProcessId
KeQuerySystemTime
EtwWrite
EtwEventEnabled
PsGetThreadId
KeCancelTimer
KeSetTimer
ExReInitializeRundownProtectionCacheAware
ExWaitForRundownProtectionReleaseCacheAware
ExReleaseRundownProtectionCacheAware
PoCallDriver
PoStartNextPowerIrp
ExAcquireRundownProtectionCacheAware
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
memmove
IoVolumeDeviceToDosName
IoQueueWorkItem
FsRtlGetVirtualDiskNestingLevel
ZwWaitForSingleObject
ZwOpenEvent
ExAllocatePoolWithTagPriority
KeReadStateEvent
MmProbeAndLockPages
ZwMapViewOfSection
ZwCreateSection
IoGetAttachedDeviceReference
ZwCreateFile
IoBuildSynchronousFsdRequest
IoInvalidateDeviceRelations
FsRtlIsTotalDeviceFailure
IoFreeWorkItem
IoAllocateWorkItem
PsTerminateSystemThread
KeSetPriorityThread
ExUuidCreate
IoInitializeWorkItem
KeInitializeDpc
KeInitializeTimer
ExInitializeRundownProtectionCacheAware
KeInitializeSemaphore
IoAttachDeviceToDeviceStack
IoDeleteDevice
IoGetDriverObjectExtension
IoCreateDevice
IoSizeofWorkItem
ExSizeOfRundownProtectionCacheAware
ZwSetInformationThread
PsCreateSystemThread
ZwQueryDirectoryFile
ZwDuplicateObject
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlGUIDFromString
KeClearEvent
IoForwardIrpSynchronously
ObReleaseObjectSecurity
ObSetSecurityObjectByPointer
ObGetObjectSecurity
IoCreateSymbolicLink
IoUninitializeWorkItem
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
IoGetDeviceProperty
IoUnregisterPlugPlayNotification
IoDetachDevice
IoRegisterPlugPlayNotification
PsSetThreadHardErrorsAreDisabled
PsGetThreadHardErrorsAreDisabled
PoRegisterPowerSettingCallback
EtwRegister
RtlInitializeGenericTableAvl
ExDeleteNPagedLookasideList
ExInitializeNPagedLookasideList
IoRegisterBootDriverReinitialization
IoRegisterDriverReinitialization
IoAllocateDriverObjectExtension
RtlInsertElementGenericTableFullAvl
RtlLookupElementGenericTableFullAvl
KeBugCheckEx
RtlUnwind
KeGetCurrentThread
InterlockedPushEntrySList
IoBuildPartialMdl
InterlockedPopEntrySList
EtwUnregister
EtwProviderEnabled
hal
KfAcquireSpinLock
KfReleaseSpinLock
KeGetCurrentIrql
Sections
.text Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 353B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGELK Size: 157KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 1024B - Virtual size: 1015B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ