redbook.pdb
Static task
static1
1 signatures
General
-
Target
3b7835d2b72ebd4134ad7d80fc556a36_JaffaCakes118
-
Size
56KB
-
MD5
3b7835d2b72ebd4134ad7d80fc556a36
-
SHA1
dbb07ede78aadf50e9a0d3e115c8dc1bba578471
-
SHA256
bb30a5146a555b754f3e3862f1dc2ffaf27c697dd3269ab49ddacb4918fe608a
-
SHA512
3247be24caa868296eb266726c926c5988093b7803dd8e9c28e43539318c297af51ae5f282d98c4de4f49291e1323dbdf4ea0253a75f1d0ddafd3d9289d80a0d
-
SSDEEP
768:nIDbEntQZ0AxwZuheJ6CuFAqaSeyLkmmK6L2j877pk75cfb5K:LntQZz2dqaStLkmAL2j87y65K
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3b7835d2b72ebd4134ad7d80fc556a36_JaffaCakes118
Files
-
3b7835d2b72ebd4134ad7d80fc556a36_JaffaCakes118.sys windows:5 windows x86 arch:x86
f60ea72a595b25ed2508cd0ace948e2d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
IoGetDeviceInterfaces
wcslen
WmiQueryTraceInformation
IoWMIRegistrationControl
RtlCopyUnicodeString
ExAllocatePoolWithTag
IoGetDriverObjectExtension
IoAllocateDriverObjectExtension
IofCallDriver
IoDeleteDevice
IoDetachDevice
PsCreateSystemThread
KeInitializeSpinLock
IoInitializeRemoveLockEx
KeInitializeEvent
IoAttachDeviceToDeviceStack
IoCreateDevice
IoReleaseRemoveLockEx
KeSetEvent
KeWaitForSingleObject
IofCompleteRequest
IoAcquireRemoveLockEx
IoUnregisterPlugPlayNotification
IoReleaseRemoveLockAndWaitEx
IoRegisterPlugPlayNotification
ExfInterlockedInsertTailList
ZwCreateFile
ExfInterlockedRemoveHeadList
KeQueryTimeIncrement
KeTickCount
KeWaitForMultipleObjects
KeSetPriorityThread
KeGetCurrentThread
_alldiv
_allmul
IoReuseIrp
IoFreeMdl
IoFreeIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoAllocateIrp
KeClearEvent
IoBuildDeviceIoControlRequest
RtlQueryRegistryValues
ZwOpenKey
IoOpenDeviceRegistryKey
RtlWriteRegistryValue
ZwCreateKey
_aulldiv
PoCallDriver
PoStartNextPowerIrp
IoInitializeIrp
KeBugCheckEx
ExFreePoolWithTag
ObReferenceObjectByHandle
ZwClose
ObfDereferenceObject
IoGetRelatedDeviceObject
WmiTraceMessage
IoAllocateErrorLogEntry
PsTerminateSystemThread
IoWriteErrorLogEntry
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiCompleteRequest
WmiSystemControl
ks.sys
KsCreatePin
KsSynchronousIoControlDevice
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGERW Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGECONS Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ