x:\dnsblocker\driver\objfre_wnet_amd64\amd64\WZS.pdb
Static task
static1
1 signatures
General
-
Target
0f4ae8eaa21463cc59abc83611517eaf_JaffaCakes118
-
Size
33KB
-
MD5
0f4ae8eaa21463cc59abc83611517eaf
-
SHA1
a84a85bf47f88ecd5e345772a15e96f810e93413
-
SHA256
b30503fb0eb8ffb6711df39dd5e2c8b305ea8c1d60cc81df51affa2f8e4a0713
-
SHA512
0c2af8cf64883bfad99ac4d1daeecf8a285d89d859e2b58f1c6f7e0dff0c6fab45e0ab9fb955aa2035b832a59e0d02984269197d3607a66d8ecc298c5b6a30e4
-
SSDEEP
768:r4TIRpXe0SEKcVV/Jnc5AxoT1ZcZ/BnFsIciZRxwNp31Hb7wz:r/hSEK2xJg1ZcBZegRSbJb7wz
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f4ae8eaa21463cc59abc83611517eaf_JaffaCakes118
Files
-
0f4ae8eaa21463cc59abc83611517eaf_JaffaCakes118.sys windows:6 windows x64 arch:x64
f978c9d9139bd3dd262aae448e74016b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
ntoskrnl.exe
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IofCompleteRequest
IoDetachDevice
ObfDereferenceObject
IofCallDriver
IoFreeMdl
IoAllocateMdl
IoBuildDeviceIoControlRequest
MmBuildMdlForNonPagedPool
PsGetCurrentProcessId
ExFreePoolWithTag
KeInitializeTimer
KeRemoveQueueDpc
KeCancelTimer
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
IoFreeIrp
IoAllocateIrp
MmMapLockedPagesSpecifyCache
KeSetTimer
swprintf
RtlAppendUnicodeToString
RtlInitUnicodeString
IoGetDeviceObjectPointer
IoAttachDeviceToDeviceStack
KeBugCheckEx
KeInitializeDpc
ExAllocatePoolWithTag
tdi.sys
TdiMapUserRequest
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 876B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 776B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ