ws2ifsl.pdb
Static task
static1
1 signatures
General
-
Target
17bfd189d2b74244da483e87239467cb_JaffaCakes118
-
Size
11KB
-
MD5
17bfd189d2b74244da483e87239467cb
-
SHA1
8c0b761763ad7435adb9a96b72fc446c0205ac36
-
SHA256
9ec793f1267d894ce415eb1f6a02cacd760b7f47b2d97c96f5a305c0b0ebd773
-
SHA512
eafa12b3bb4f76ecc1586c6b2db0a164afe68316eda123e0b02285076426bf0dc37d21b3c9f0f07ee0f9105f45f740cee623230525da6f0056779c120f1f22a7
-
SSDEEP
192:sLrAkUzB4jOHXVzUTAN2SFx0i3yBFGm8uY1YMAPMG66zd+L44PuF/DmCwNULTo3m:CAkUz2jOHXVUWHEBr8uYJXA+cZduUjhM
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 17bfd189d2b74244da483e87239467cb_JaffaCakes118
Files
-
17bfd189d2b74244da483e87239467cb_JaffaCakes118.sys windows:5 windows x86 arch:x86
7a1a55c1c8bf44d722d176a6442739f5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IoCreateDevice
RtlInitUnicodeString
IoAllocateMdl
ExRaiseAccessViolation
MmUserProbeAddress
ExRaiseDatatypeMisalignment
ExRaiseStatus
ExFreePoolWithTag
ObfDereferenceObject
ProbeForWrite
ObReferenceObjectByHandle
PsGetCurrentProcessId
ExAllocatePoolWithQuotaTag
IoGetCurrentProcess
IoThreadToProcess
IoDeleteDevice
IoGetRelatedDeviceObject
IoFileObjectType
IoReleaseCancelSpinLock
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
KeInitializeApc
KeInitializeSpinLock
KeInsertQueueApc
IoFreeMdl
IoAcquireCancelSpinLock
ObfReferenceObject
IoFreeIrp
IofCallDriver
IoBuildAsynchronousFsdRequest
_except_handler3
ExGetPreviousMode
PsThreadType
IofCompleteRequest
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 384B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 160B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 544B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ