tdtcp.pdb
Static task
static1
1 signatures
General
-
Target
2eead05f03128f5ee93e04437823db11_JaffaCakes118
-
Size
22KB
-
MD5
2eead05f03128f5ee93e04437823db11
-
SHA1
4cbeff504cc231d27b323d3c0a2d8e716c2ceef8
-
SHA256
6a78066ac2a8514619b383902b6918ddb70e3327b63096278458399f60b74152
-
SHA512
dd0e8da7572eacd550e0f8b183ea76669ca777ea38aa2e64388790eadb03a34d25062dc35bfe9ede8a77b5cc83e2ec7ddb5c9cadf36d344b7d44f4916f74762f
-
SSDEEP
384:BfpA/CR1fjTLPDscjkKtTftqSj1NrEUcHG+7JPMNQP4JlGsEZSWD8qqwWzjWD8qq:xy/UJLPNTf0y1Nrwn7dgQPml0cqyqq
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2eead05f03128f5ee93e04437823db11_JaffaCakes118
Files
-
2eead05f03128f5ee93e04437823db11_JaffaCakes118.sys windows:5 windows x86 arch:x86
4a187c0fc1bd5111930f0ac753fbadfe
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
KeBugCheckEx
KeTickCount
wcscpy
RtlInitUnicodeString
RtlAppendUnicodeToString
ZwClose
isdigit
isxdigit
islower
KeInitializeEvent
KeInitializeSpinLock
ObfDereferenceObject
DbgPrint
KeGetCurrentThread
KeResetEvent
KeSetEvent
IoFreeMdl
isspace
ZwOpenKey
ZwQueryValueKey
RtlCopyUnicodeString
ZwEnumerateKey
IofCallDriver
IoSetCompletionRoutineEx
IoDeleteDevice
IofCompleteRequest
IoCreateDevice
wcscat
ObReferenceObjectByHandle
IoInitializeIrp
MmSizeOfMdl
_except_handler3
IoCancelIrp
KeClearEvent
ObfReferenceObject
ExfInterlockedInsertTailList
NtSetInformationThread
ProbeForRead
MmBuildMdlForNonPagedPool
IoFreeIrp
IoGetCurrentProcess
ProbeForWrite
_allmul
IoGetRelatedDeviceObject
IoFileObjectType
ZwCreateFile
IoAllocateIrp
PsIsThreadTerminating
KeWaitForSingleObject
IoAllocateMdl
IoBuildDeviceIoControlRequest
wcslen
MmUnlockPages
RtlUnicodeToMultiByteN
termdd.sys
IcaQueueWorkItemEx
IcaSleep
IcaCreateHandle
IcaCloseHandle
IcaReturnHandle
IcaRawInput
IcaChannelInput
IcaBufferFree
IcaBufferError
IcaCreateThread
IcaStackAllocatePoolWithTag
IcaStackFreePool
IcaWaitForSingleObject
IcaAllocateWorkItem
IcaStackAllocatePool
hal
KfReleaseSpinLock
KfAcquireSpinLock
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 640B - Virtual size: 548B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 128B - Virtual size: 64B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ttuq Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 1008B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 768B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ