jaffacakes118_Rootkit[.]Win32[.]Ressdt[.]hd[.]2b9c38c561c788a731b832852741af94

General

Target
jaffacakes118_Rootkit.Win32.Ressdt.hd.2b9c38c561c788a731b832852741af94
Size 11KB
Sample261014-krhyvsav8x
SHA256 1bc38e7834b5e4378f613928f41ada367ec851c171aab9e596a03c1a506285e4
MD5 2b9c38c561c788a731b832852741af94
SHA1 6156807b26d80affeee03d881d1ece927a26ed58
SHA512 89811bf521add34fb6c93b3fe7e3102ffc9367c861d75f41a4d652e65f219a85b83269c0cf661b12f2009eb8e28a3cc78317dfb94581180ce13013f33034544c
SSDEEP 192:ngdXAAcuL8OWb13NZanVFgY6lgpHcl+EK5:ngdFt8ZaV6ZkHcM55
TLSH
T196429161F7D04F26D07B00784C1FBB705C2E7C21EA1BDA2322568BCE3E5211A965B63B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Rootkit.Win32.Ressdt.hd.2b9c38c561c788a731b832852741af94

jaffacakes118_Rootkit.Win32.Ressdt.hd.2b9c38c561c788a731b832852741af94

.sys 11KB

IMPHASH 97a8fcb81cca995ded498133c0d6f73a
SHA256 1bc38e7834b5e4378f613928f41ada367ec851c171aab9e596a03c1a506285e4
MD5 2b9c38c561c788a731b832852741af94
SHA1 6156807b26d80affeee03d881d1ece927a26ed58
SHA512 89811bf521add34fb6c93b3fe7e3102ffc9367c861d75f41a4d652e65f219a85b83269c0cf661b12f2009eb8e28a3cc78317dfb94581180ce13013f33034544c
SSDEEP 192:ngdXAAcuL8OWb13NZanVFgY6lgpHcl+EK5:ngdFt8ZaV6ZkHcM55
TLSH
T196429161F7D04F26D07B00784C1FBB705C2E7C21EA1BDA2322568BCE3E5211A965B63B
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

1

Major OS version

5

Entry point

2181

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

e:\gh0st\server\sys\i386\RESSDT.pdb