e:\passthru\siglow\driver\objfre_wxp_x86\i386\vmware.pdb
Static task
static1
1 signatures
General
-
Target
2e41615c06e071d157a9b59adf6b8300_JaffaCakes118
-
Size
14KB
-
MD5
2e41615c06e071d157a9b59adf6b8300
-
SHA1
37f652ce894fb893cb7ade5bcbd73336d019d2ae
-
SHA256
e9ff55ccdb390bb87c74cbb748b553d4a8df6a61424a5ee395f77876db8cfc6d
-
SHA512
d4bd37c8b0d0539018febdccad1f3b9c814b7660cb99e88d2633b61678b1e759f9636056ac3c5eb006a3b64c4251bcbfe5d3d8fede4f59b0d60e2cdd3b779d4c
-
SSDEEP
192:/uTZ6dmSH3cXSvOV4vq7dctcoL9H3uCCUPGTnEIGQswQ:/ZdmIMimIejG9+Csgd
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2e41615c06e071d157a9b59adf6b8300_JaffaCakes118
Files
-
2e41615c06e071d157a9b59adf6b8300_JaffaCakes118.sys windows:6 windows x86 arch:x86
112a10e87ff78316cc01d256069fa8a4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeTickCount
IofCompleteRequest
RtlInitUnicodeString
memset
memcpy
MmMapLockedPagesSpecifyCache
strstr
hal
KfReleaseSpinLock
KfAcquireSpinLock
ndis.sys
NdisReEnumerateProtocolBindings
NdisIMDeInitializeDeviceInstance
NdisGetReceivedPacket
NdisDprAllocatePacket
NdisIMCancelInitializeDeviceInstance
NdisIMNotifyPnPEvent
NdisQueryPendingIOCount
NdisCloseAdapter
NdisSetEvent
NdisMSetAttributesEx
NdisIMGetDeviceContext
NdisFreePacket
NdisIMCopySendCompletePerPacketInfo
NdisIMCopySendPerPacketInfo
NdisAllocatePacket
NdisIMGetCurrentPacketStack
NdisRequest
NdisMIndicateStatusComplete
NdisMIndicateStatus
NdisReturnPackets
NdisGetPoolFromPacket
NdisCancelSendPackets
NdisFreePacketPool
NdisFreeMemory
NdisAllocateMemory
NdisWaitEvent
NdisResetEvent
NdisMDeregisterDevice
NdisDeregisterProtocol
NdisTerminateWrapper
NdisIMAssociateMiniport
NdisIMDeregisterLayeredMiniport
NdisRegisterProtocol
NdisMRegisterUnloadHandler
NdisIMRegisterLayeredMiniport
NdisInitializeWrapper
NdisMRegisterDevice
NdisMSleep
NdisCloseConfiguration
NdisIMInitializeDeviceInstanceEx
NdisOpenAdapter
NdisAllocatePacketPoolEx
NdisInitializeEvent
NdisAllocateMemoryWithTag
NdisReadConfiguration
NdisOpenProtocolConfiguration
NdisDprFreePacket
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 349B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 640B - Virtual size: 634B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ