c:\reliz2\driver_rootkit2\tst_hook\m_hook.pdb
Static task
static1
1 signatures
General
-
Target
29a2e977c6d3238b885b52d64adbbdf8_JaffaCakes118
-
Size
65KB
-
MD5
29a2e977c6d3238b885b52d64adbbdf8
-
SHA1
b86989d10ed6c372a93a99a1a698be3fc20b773f
-
SHA256
f6d93bb933147fdee00f486190ca3a8a75f335307becc430accee98d5258ea6d
-
SHA512
5a190db939089edd3e8af07023a35472f5892586212b8c4eabb43fc3a36db698c71ec4e3d0c9e5d21c4e0c00333364691dfcf27301571f6e26eb9dcb4dd60ef8
-
SSDEEP
1536:j1Newg82JKUuDwDEGmnJdVFEmO5G2D/xxGTwYRoefUlUMUqf:ZNewg8zU3DEGcJdVFEmO5G27xxGTwYy0
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 29a2e977c6d3238b885b52d64adbbdf8_JaffaCakes118
Files
-
29a2e977c6d3238b885b52d64adbbdf8_JaffaCakes118.sys windows:5 windows x86 arch:x86
d813da8efba3635023e2b0ca070d8005
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExAllocatePoolWithTag
ZwClose
_stricmp
strncpy
strchr
ZwReadFile
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
_wcsicmp
ZwUnmapViewOfSection
wcslen
PsSetLoadImageNotifyRoutine
IofCallDriver
IofCompleteRequest
_strnicmp
IoGetRequestorProcess
PsGetVersion
strncmp
IoGetCurrentProcess
ZwQueryDirectoryFile
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQuerySystemInformation
KeServiceDescriptorTable
IoAttachDeviceToDeviceStack
IoCreateDevice
IoGetDeviceObjectPointer
IoDeleteDevice
IoDetachDevice
ObfDereferenceObject
ExReleaseFastMutexUnsafe
IoCreateSymbolicLink
ExAcquireFastMutexUnsafe
IoDeleteSymbolicLink
KeInitializeEvent
_except_handler3
RtlCompareUnicodeString
ObQueryNameString
ObReferenceObjectByHandle
ZwOpenKey
wcscat
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ProbeForRead
KeTickCount
KeBugCheckEx
InterlockedExchange
ExFreePool
hal
KfAcquireSpinLock
Sections
.text Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ