redbook.pdb
Static task
static1
1 signatures
General
-
Target
0f5145dcb186071ab8eeaf42aa394ded_JaffaCakes118
-
Size
57KB
-
MD5
0f5145dcb186071ab8eeaf42aa394ded
-
SHA1
1f44d7137b810a6f36302bf1bb6106dd529a2053
-
SHA256
810ca4aa3c23cf4bd448a53665cb287c6c3d9d69d214cbbbb9cd98445b6b7908
-
SHA512
b55b68355be8436b6dad61dc9267e1a664742e04f94d813b5f11884ef42d46a2f438c205adcd48e04512455ed9a87d576cecf384ed055872349b5b979039fb3f
-
SSDEEP
768:EvM9HDkL0716NBg4bI8kyZN5GeLuAtbwGf+MhVxcs8Km5keq2ZX2PTYnGNWBcqwI:MNXtNvq5Y0qtoKTITYCIOpux
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0f5145dcb186071ab8eeaf42aa394ded_JaffaCakes118
Files
-
0f5145dcb186071ab8eeaf42aa394ded_JaffaCakes118.sys windows:5 windows x86 arch:x86
f60ea72a595b25ed2508cd0ace948e2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
IoGetDeviceInterfaces
wcslen
WmiQueryTraceInformation
IoWMIRegistrationControl
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoGetDriverObjectExtension
IoAllocateDriverObjectExtension
IofCallDriver
IoDeleteDevice
IoDetachDevice
PsCreateSystemThread
KeInitializeSpinLock
IoInitializeRemoveLockEx
KeInitializeEvent
IoAttachDeviceToDeviceStack
IoCreateDevice
IoReleaseRemoveLockEx
KeSetEvent
KeWaitForSingleObject
IofCompleteRequest
IoAcquireRemoveLockEx
IoUnregisterPlugPlayNotification
IoReleaseRemoveLockAndWaitEx
IoRegisterPlugPlayNotification
ExfInterlockedInsertTailList
ZwCreateFile
ExfInterlockedRemoveHeadList
KeQueryTimeIncrement
KeTickCount
KeWaitForMultipleObjects
KeSetPriorityThread
KeGetCurrentThread
_alldiv
_allmul
IoReuseIrp
IoFreeMdl
IoFreeIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
KeClearEvent
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
ZwOpenKey
IoOpenDeviceRegistryKey
RtlWriteRegistryValue
ZwCreateKey
_aulldiv
PoCallDriver
PoStartNextPowerIrp
IoInitializeIrp
KeBugCheckEx
ExFreePoolWithTag
ObReferenceObjectByHandle
ZwClose
ObfDereferenceObject
IoGetRelatedDeviceObject
WmiTraceMessage
IoAllocateErrorLogEntry
PsTerminateSystemThread
IoWriteErrorLogEntry
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiCompleteRequest
WmiSystemControl
ks.sys
KsCreatePin
KsSynchronousIoControlDevice
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGERW Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGECONS Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ