sffp_mmc.pdb
Static task
static1
General
-
Target
44641971b70491a89218cf1189b6c662_JaffaCakes118
-
Size
146KB
-
MD5
44641971b70491a89218cf1189b6c662
-
SHA1
593891ad3e54eafde7f4df7cf5e613153bbaf2cb
-
SHA256
781f94783459e053d73806d108d3ccf7ae0f05f5623dc84aa99f9f3b6e43c755
-
SHA512
6b1f49b3f167b5c7b9ffea22bdd15f00add4c32dfd8bad80ae2aec1ae69c34336389087b3136e24a6b7357a0ce1398fd342abd4a9e8d3994b19124b693ef83ad
-
SSDEEP
3072:FZsZf8x+DBuE6HkDOcg1tR0h0Ley2J3ZWAL1st/X2wE:HuG4ujUO5Ch0LW1k/GwE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 44641971b70491a89218cf1189b6c662_JaffaCakes118
Files
-
44641971b70491a89218cf1189b6c662_JaffaCakes118.sys windows:5 windows x86 arch:x86
e51d623da11b3415bbb90f8390180241
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePoolWithTag
_except_handler3
IofCompleteRequest
IofCallDriver
KeWaitForSingleObject
KeInitializeEvent
_allmul
_allshl
KeSetEvent
IoFreeIrp
IoDeleteDevice
IoAllocateMdl
IoAttachDeviceToDeviceStack
IoCreateDevice
PoStartNextPowerIrp
IoAllocateIrp
RtlCompareMemory
PoCallDriver
ZwQueryValueKey
RtlInitUnicodeString
ZwClose
ZwOpenKey
KeTickCount
KeBugCheckEx
MmBuildMdlForNonPagedPool
IoDetachDevice
IoFreeMdl
ObfDereferenceObject
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 768B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 640B - Virtual size: 524B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE