audstub.pdb
Static task
static1
General
-
Target
17456ef9ed6a37a82ffcbe1ecd5a0582_JaffaCakes118
-
Size
22KB
-
MD5
17456ef9ed6a37a82ffcbe1ecd5a0582
-
SHA1
a7847a0021e17f0647ee0d258033d7d770167b9e
-
SHA256
9de04b167fc14c23173b381003c636a6c668f878c1fea83398224a7634e222d1
-
SHA512
edcda35ea003070a603e7c95c4906d2c6bb779847cfa64e0256288e79ba512187031c0f4a6fe478842bff8ebbe917a25f8da1461215ea3ca00fc128148a4c7aa
-
SSDEEP
384:WY04cWYLwW4OM+XZ5N1m+kDJ/D71X9FFmF2OZkizgbDp3CFNjgfsDH1muqNeNGWY:VOyOxPN1DkDJ/D75OkStFNsEprqr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17456ef9ed6a37a82ffcbe1ecd5a0582_JaffaCakes118
Files
-
17456ef9ed6a37a82ffcbe1ecd5a0582_JaffaCakes118.sys windows:5 windows x86 arch:x86
556f66eecd31a12a766415046a77e3be
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoAttachDeviceToDeviceStack
IoCreateDevice
IofCallDriver
IoDeleteDevice
IoDetachDevice
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
PoSetPowerState
Sections
.text Size: 128B - Virtual size: 30B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 128B - Virtual size: 112B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PAGE Size: 512B - Virtual size: 397B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 384B - Virtual size: 328B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ewsy Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 984B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 128B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ