c:\eclipse\botnet\drivers\Bin\i386\kernel.pdb
Static task
static1
1 signatures
General
-
Target
3dab655e7f2b5bffc7d3975e3c0fff08_JaffaCakes118
-
Size
64KB
-
MD5
3dab655e7f2b5bffc7d3975e3c0fff08
-
SHA1
60140b42a938db50643b85e38a1e5a1265035295
-
SHA256
5db30d21aa69678e1e65194a76f78e6e421681b6af63c9029b7a2a3a5bbb92b2
-
SHA512
2413581b0372fedbcc8ae7225fa40e3e11738033238d18daf93ba8c3055d94fb99850d39141de4330bc6767099d59626f103c73e66637012c83e526916046ab4
-
SSDEEP
768:6nqD3IxEFtDUw+eOiL/LteQlMuW+5jjSgfakCMYEe7xEo6GNdVZ6RSuT+H3Q650y:64Yxbw+eXLDteQGu6aSbIlqlaa3ly
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3dab655e7f2b5bffc7d3975e3c0fff08_JaffaCakes118
Files
-
3dab655e7f2b5bffc7d3975e3c0fff08_JaffaCakes118.sys windows:6 windows x86 arch:x86
31aebfff071ae588eb611b6fb502403f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
IofCompleteRequest
PoCallDriver
PoStartNextPowerIrp
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
ObfReferenceObject
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
IoCreateFile
memcpy
IofCallDriver
IoAttachDevice
_purecall
IoGetCurrentProcess
ExFreePoolWithTag
_stricmp
KeGetCurrentThread
KeWaitForSingleObject
IoAllocateIrp
KeClearEvent
IoFileObjectType
strcmp
strncat
NtQuerySystemInformation
ZwClose
KeServiceDescriptorTable
ObInsertObject
MmIsAddressValid
sprintf
KeBugCheckEx
PsGetVersion
IoBuildDeviceIoControlRequest
KeInitializeEvent
memset
RtlFreeUnicodeString
RtlCompareUnicodeString
RtlCopyUnicodeString
MmGetSystemRoutineAddress
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlQueryRegistryValues
IoRegisterShutdownNotification
KeSetPriorityThread
PsCreateSystemThread
RtlUnicodeStringToInteger
RtlTimeToTimeFields
_allmul
RtlWriteRegistryValue
RtlCreateRegistryKey
swprintf
RtlDeleteRegistryValue
ObQueryNameString
IoFreeIrp
SeSetAccessStateGenericMapping
RtlMapGenericMask
SeCreateAccessState
ObCreateObject
IoFreeMdl
MmUnlockPages
IoCancelIrp
MmProbeAndLockPages
IoAllocateMdl
KeWaitForMultipleObjects
KeResetEvent
KeNumberProcessors
_aulldiv
RtlAnsiStringToUnicodeString
RtlInitAnsiString
KeTickCount
ExAllocatePoolWithTag
RtlInitUnicodeString
IoDriverObjectType
ObReferenceObjectByName
KeSetEvent
ObfDereferenceObject
strncpy
wcsncpy
strlen
RtlCompareMemory
ZwReadFile
ZwWriteFile
KeQuerySystemTime
strchr
wcschr
RtlUnwind
hal
KfReleaseSpinLock
KfLowerIrql
KfRaiseIrql
KeGetCurrentIrql
KfAcquireSpinLock
Sections
page Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ