ftdisk.pdb
Static task
static1
1 signatures
General
-
Target
1153588c41676b8f745f061f835ee616_JaffaCakes118
-
Size
123KB
-
MD5
1153588c41676b8f745f061f835ee616
-
SHA1
7d3a9704e4d033c4368e9484fea7d5777436e234
-
SHA256
65ad6a934ecb798d339e22a096935047dd13ddafc693218c57c1521b1ce30e55
-
SHA512
e04b47fc2c182627be886e2ce0093c6e2ad14d64ce95164771767e2f3c6b5edaae2b594343ee83e1c737c81363681a06297ec923efcfe4610835bc52bcdf683e
-
SSDEEP
3072:MhdvNbNxPAPY23YB/y0sNfVkwT1nvVcYA:ERDmY2oB/y0sNphnvV
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1153588c41676b8f745f061f835ee616_JaffaCakes118
Files
-
1153588c41676b8f745f061f835ee616_JaffaCakes118.sys windows:5 windows x86 arch:x86
3bd9ebbaa28f067d72f14003863c2b19
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
HalExamineMBR
IoBuildDeviceIoControlRequest
IoGetAttachedDeviceReference
ObfDereferenceObject
KeQuerySystemTime
ExUuidCreate
_allshr
_allmul
memmove
RtlWriteRegistryValue
RtlQueryRegistryValues
RtlCompareMemory
DbgPrint
ObReferenceObjectByHandle
_purecall
RtlCompareUnicodeString
IoGetDeviceObjectPointer
RtlInitUnicodeString
swprintf
IoCreateSymbolicLink
IoDeleteSymbolicLink
IoRegisterDeviceInterface
IoWMIRegistrationControl
IofCompleteRequest
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
RtlDeleteRegistryValue
RtlCreateRegistryKey
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
KeReleaseSemaphore
IoReleaseCancelSpinLock
KeSetEvent
PoCallDriver
PoStartNextPowerIrp
PsTerminateSystemThread
ExQueueWorkItem
IoRegisterShutdownNotification
KeInitializeSemaphore
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
KeInitializeSpinLock
IoCreateDevice
PoRequestPowerIrp
PoSetPowerState
IoAcquireCancelSpinLock
IoReportTargetDeviceChangeAsynchronous
KeInitializeEvent
KeClearEvent
RtlStringFromGUID
IoSetSystemPartition
ZwClose
ZwFsControlFile
ZwOpenFile
IoInvalidateDeviceRelations
PsCreateSystemThread
RtlEqualUnicodeString
ObfReferenceObject
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
RtlVolumeDeviceToDosName
KeBugCheckEx
IoGetBootDiskInformation
MmLockPagableDataSection
IoInvalidateDeviceState
IoSetDeviceInterfaceState
IoGetDeviceProperty
IoUnregisterShutdownNotification
_alldiv
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
RtlCopyUnicodeString
IoReportDetectedDevice
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
IoFreeMdl
IoAllocateMdl
MmBuildMdlForNonPagedPool
IoAllocateIrp
FsRtlIsTotalDeviceFailure
IoFreeIrp
IoReuseIrp
IoBuildPartialMdl
MmUnmapLockedPages
_allrem
_alldvrm
_allshl
MmMapLockedPages
IoRaiseInformationalHardError
KeGetCurrentThread
wcslen
ZwQueryValueKey
ZwOpenKey
ZwSetSecurityObject
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
_except_handler3
IoBuildSynchronousFsdRequest
IofCallDriver
KeWaitForSingleObject
strncmp
IoReadPartitionTableEx
ExFreePoolWithTag
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 36B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGELK Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ