netbt.pdb
Static task
static1
1 signatures
General
-
Target
2c8e21b03657cba1295c0d4f3b7a072b_JaffaCakes118
-
Size
159KB
-
MD5
2c8e21b03657cba1295c0d4f3b7a072b
-
SHA1
47cbf4c93030f38ae8a0c2906913a93fb027dd7a
-
SHA256
dc9a4bef3dd956d80ffe5f20a9920adea0561d96a60b33478c864e5692e7fe75
-
SHA512
d4c937a933948e9a0b49869b058f01b2e4ef810458938a60f47fbb791fc72f84e4e42cd392383e3e5f403c124f40969bb004b9b262843f0d1e4298559116676a
-
SSDEEP
3072:JnSpn2UKUlz/h9tgZY0Dv0DzxOpyveIn0C2cJaJFs0r9gkJKqDm+hnBRjvt:IdKUlbzwA0C2ckJ4f+5BRjv
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2c8e21b03657cba1295c0d4f3b7a072b_JaffaCakes118
Files
-
2c8e21b03657cba1295c0d4f3b7a072b_JaffaCakes118.sys windows:5 windows x86 arch:x86
b1e53e21d8f497ddfb48aee965d42e88
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
hal
KfReleaseSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
ntoskrnl.exe
_alldiv
SeDeassignSecurity
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
DbgPrint
RtlAnsiStringToUnicodeString
RtlUnicodeStringToAnsiString
RtlOemStringToUnicodeString
RtlInitString
MmMapLockedPagesSpecifyCache
RtlAppendStringToString
RtlInitAnsiString
strchr
strncpy
KeCancelTimer
ZwClose
ZwCancelTimer
ZwSetTimer
ZwCreateTimer
_aulldiv
_allmul
IofCompleteRequest
IofCallDriver
IoBuildDeviceIoControlRequest
ObfReferenceObject
IoGetDeviceObjectPointer
RtlInitUnicodeString
KeSetTimer
KeInitializeDpc
KeInitializeTimer
IoDeleteDevice
KeClearEvent
ExDeleteResourceLite
IoFreeIrp
IoGetRelatedDeviceObject
ProbeForWrite
_except_handler3
RtlCopyUnicodeString
DbgBreakPoint
ZwCreateKey
memchr
ZwReadFile
ZwQueryInformationFile
RtlFreeUnicodeString
ZwCreateFile
IoRemoveShareAccess
SeAssignSecurity
RtlExtendedLargeIntegerDivide
IoCheckShareAccess
SeAccessCheck
ObReferenceObjectByHandle
NtWaitForSingleObject
ZwDeviceIoControlFile
ZwCreateEvent
wcslen
ExfInterlockedPushEntryList
ExRaiseAccessViolation
MmUserProbeAddress
IoFileObjectType
PsGetCurrentThread
ExQueueWorkItem
KeInsertQueueDpc
IoAllocateIrp
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
RtlIntegerToUnicodeString
RtlExtendedMagicDivide
MmBuildMdlForNonPagedPool
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
swprintf
sprintf
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlMapGenericMask
IoGetFileObjectGenericMapping
SeSetSecurityDescriptorInfo
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
IoCreateDevice
RtlAppendUnicodeToString
ZwOpenKey
ZwQueryValueKey
memmove
IoBuildPartialMdl
MmUnmapLockedPages
KeDelayExecutionThread
MmLockPagableDataSection
KeTickCount
KeBugCheckEx
IoCancelIrp
IoAllocateMdl
ExfInterlockedInsertHeadList
PsGetCurrentProcess
KeAttachProcess
KeDetachProcess
ExfInterlockedInsertTailList
ObfDereferenceObject
IoFreeMdl
KeWaitForSingleObject
KeResetEvent
KeSetEvent
KeInitializeSpinLock
ExSystemTimeToLocalTime
KeInitializeEvent
ExInitializeResourceLite
strrchr
RtlCompareMemory
KeQuerySystemTime
KefReleaseSpinLockFromDpcLevel
KefAcquireSpinLockAtDpcLevel
IoAcquireCancelSpinLock
IoReleaseCancelSpinLock
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
strncmp
ExAllocatePoolWithTag
IoSetShareAccess
ExFreePoolWithTag
tdi.sys
TdiRegisterNetAddress
TdiProviderReady
TdiInitialize
TdiRegisterProvider
TdiRegisterPnPHandlers
TdiMapUserRequest
TdiDeregisterPnPHandlers
TdiDeregisterProvider
TdiRegisterDeviceObject
TdiDefaultDisconnectHandler
TdiDefaultErrorHandler
TdiDefaultReceiveHandler
TdiDefaultRcvExpeditedHandler
TdiDefaultSendPossibleHandler
TdiCopyMdlToBuffer
TdiCopyBufferToMdl
TdiDefaultRcvDatagramHandler
TdiBuildNetbiosAddress
TdiDeregisterDeviceObject
TdiDeregisterNetAddress
TdiPnPPowerComplete
TdiEnumerateAddresses
TdiDefaultConnectHandler
TdiPnPPowerRequest
Sections
.text Size: 107KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 896B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGENBT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 992B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ