c:\winddk\demo\_darkshell\i386\DarkShell.pdb
Static task
static1
General
-
Target
1475254570da3872dcc781a5c1130b58_JaffaCakes118
-
Size
4KB
-
MD5
1475254570da3872dcc781a5c1130b58
-
SHA1
3ef34e985762e725e6ee3b5b637e9cae45577bd1
-
SHA256
6bf6fcec76bd0831f3770e3e9f149e0ef20e7316c9947660de90b0152a44e1ab
-
SHA512
c85fed6278a9d1bab066e2fd27dd821f5bc45e7817ea0561caf5ccc3562b9bf587e6fb4c9502bb1d0111446b2e342d4f8eda5bcecdb4d9cbb661ce08b42a900b
-
SSDEEP
48:Qz4CSUbGEYnPH7bPKan0oJLc5dm4zk3B2MjRHR6Flyd2gOwABhVzB0DZf:QzULESLfn0oxc1/8pG6y4F
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1475254570da3872dcc781a5c1130b58_JaffaCakes118
Files
-
1475254570da3872dcc781a5c1130b58_JaffaCakes118.sys windows:6 windows x86 arch:x86
07ab1cbed45ec57fff7df0ac91b4a085
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
MmGetSystemRoutineAddress
RtlInitUnicodeString
IofCompleteRequest
DbgPrint
KeServiceDescriptorTable
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateDevice
memmove
memcpy
KeTickCount
RtlUnwind
KeBugCheckEx
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 276B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 40B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 414B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 256B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ