d:\programs\siberia\protect\objfre_wxp_x86\i386\protect.pdb
Static task
static1
1 signatures
General
-
Target
4537d927d6862d8ed69777bf0a490a0f_JaffaCakes118
-
Size
28KB
-
MD5
4537d927d6862d8ed69777bf0a490a0f
-
SHA1
e77adc09f7a03a0e471bdafaaa52b99664376b56
-
SHA256
0a22ae55edcc73705b8b736c920f56216e027e3223297b7b3be46d38e73f9df0
-
SHA512
455d6354a30648d0858421610f3b710f45e521b804f496404aec5b3796592b69d020c3c34dd6a303a18f450183cede879519d9b3f8c700a839f38fb5beff6bb4
-
SSDEEP
768:e6vVaEEKLlV4IobTKibg5fCys1nsMwm5jy:e6dFgIo3KCafClhjT5jy
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4537d927d6862d8ed69777bf0a490a0f_JaffaCakes118
Files
-
4537d927d6862d8ed69777bf0a490a0f_JaffaCakes118.sys windows:6 windows x86 arch:x86
bc5042577e5a50fe092be8ad2f1ade2e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
ntoskrnl.exe
memcpy
ExAllocatePoolWithTag
RtlAppendUnicodeStringToString
wcslen
memset
RtlInitUnicodeString
ZwClose
ZwSetValueKey
ZwCreateKey
ObfDereferenceObject
strcmp
PsLookupProcessByProcessId
ExFreePoolWithTag
wcsncpy
ZwQueryValueKey
ZwOpenKey
wcsncat
wcscpy
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoCreateSymbolicLink
IoRegisterShutdownNotification
IoCreateDevice
IofCompleteRequest
ZwWriteFile
ZwCreateFile
IoRegisterFsRegistrationChange
KeInitializeMutex
ObReferenceObjectByName
IoDriverObjectType
RtlAppendUnicodeToString
ZwQueryDirectoryObject
ZwOpenDirectoryObject
KeReleaseMutex
KeWaitForSingleObject
MmIsAddressValid
CmRegisterCallback
ExInitializeResourceLite
KeDelayExecutionThread
KeLeaveCriticalRegion
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
KeEnterCriticalRegion
RtlCopyUnicodeString
RtlCompareUnicodeString
ExAcquireResourceSharedLite
ObQueryNameString
ZwEnumerateValueKey
ExQueueWorkItem
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 384B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 768B - Virtual size: 721B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 896B - Virtual size: 846B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ