C:\9\CCTest\Driver\objfre\i386\CCTest.pdb
Static task
static1
1 signatures
General
-
Target
27a27e539fc8d96e9b518721b5f06f2d_JaffaCakes118
-
Size
7KB
-
MD5
27a27e539fc8d96e9b518721b5f06f2d
-
SHA1
09eb9a22ee3f41b828ae226b4266d8ce7fe77850
-
SHA256
02b9e29b1213552f982f41df097f93215b64ac3ee4dfb368449cedd858ed92bb
-
SHA512
ae53b457070ac94c71f234df99459ac92e85a8ef3ee794110a6214e2fde9dca65a8665d00e19cd6dc9879bfc288d59271500381309b07fed399c42089b9f894f
-
SSDEEP
96:6Lxl2f6llZpitmBThTbOkULii7Az9+WcAL60nVwZPfTCgWQcU4g:6LxxllZotmrTbeP7Ed60iNPWQ
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27a27e539fc8d96e9b518721b5f06f2d_JaffaCakes118
Files
-
27a27e539fc8d96e9b518721b5f06f2d_JaffaCakes118.sys windows:5 windows x86 arch:x86
4857d643bda512af2b70fb0e7af5b8f7
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeInitializeEvent
IoCreateDevice
InterlockedDecrement
IofCompleteRequest
ExFreePool
KeSetEvent
KeWaitForSingleObject
IofCallDriver
InterlockedIncrement
IoIsWdmVersionAvailable
RtlCopyUnicodeString
ExAllocatePoolWithTag
MmGetSystemRoutineAddress
RtlInitUnicodeString
KeDetachProcess
ZwTerminateProcess
KeAttachProcess
MmUnmapViewOfSection
PsLookupProcessByProcessId
KeServiceDescriptorTable
IoAttachDeviceToDeviceStack
RtlAppendUnicodeToString
RtlFreeUnicodeString
IoSetDeviceInterfaceState
PoCallDriver
PoStartNextPowerIrp
InterlockedExchange
KeClearEvent
KeInitializeSpinLock
_except_handler3
IoRegisterDeviceInterface
IoDetachDevice
wcslen
IoDeleteDevice
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 896B - Virtual size: 848B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 536B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ