Y:\LFdjNENlMOSsxb\GWCsnHcjfgBp\ydCFkxikQnUzNq\jYhGbtygLlbKs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0140bb2db43af2dd8b525feea09f3df5_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0140bb2db43af2dd8b525feea09f3df5_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
0140bb2db43af2dd8b525feea09f3df5_JaffaCakes118
-
Size
331KB
-
MD5
0140bb2db43af2dd8b525feea09f3df5
-
SHA1
4e81a19c7da30acd717150e76fb7d0d0cc96ca35
-
SHA256
80652a7b71f14a8b0520fc49f3078029662eaa10edfc34aeb1cf7869a5456e33
-
SHA512
13277de45c906cf58fc964c7ec0565ea46a023fcab0994d277e24d4ac3f53dd6a1659e240fad4e92fb07898c7c07a1a71c9ce1509f292e132de92c201ede371f
-
SSDEEP
6144:ITMZnJV55la/n/jtglEoa4vHg+u83lyn1q+/jst8KHfjIckkQYdWihh19:ITqVa6lZa4fg+e1q+/4ttHfjIc7Qk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0140bb2db43af2dd8b525feea09f3df5_JaffaCakes118
Files
-
0140bb2db43af2dd8b525feea09f3df5_JaffaCakes118.dll windows:5 windows x86 arch:x86
4beae630763836d9a64ee3baddcdd802
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
SeValidSecurityDescriptor
KeInitializeEvent
RtlUpcaseUnicodeString
RtlDeleteNoSplay
ObInsertObject
MmUnmapIoSpace
ZwReadFile
RtlAreBitsSet
FsRtlIsHpfsDbcsLegal
PsGetCurrentThreadId
IoFreeErrorLogEntry
KeInsertDeviceQueue
ZwEnumerateKey
RtlFreeAnsiString
CcSetBcbOwnerPointer
PsLookupThreadByThreadId
ExCreateCallback
RtlUnicodeToOemN
ExLocalTimeToSystemTime
KeInsertHeadQueue
SeUnlockSubjectContext
IoCheckQuotaBufferValidity
ExVerifySuite
PoRegisterSystemState
FsRtlDeregisterUncProvider
RtlLengthSid
ExRaiseAccessViolation
RtlAnsiStringToUnicodeString
IoDeleteController
ZwCreateFile
RtlFindClearBitsAndSet
IoReleaseVpbSpinLock
RtlEnumerateGenericTable
RtlFindLastBackwardRunClear
ExUuidCreate
RtlDowncaseUnicodeString
MmUnmapLockedPages
RtlAreBitsClear
RtlEqualString
IoGetBootDiskInformation
ZwPowerInformation
DbgBreakPoint
IoSetThreadHardErrorMode
FsRtlCheckLockForReadAccess
ZwFlushKey
IoInvalidateDeviceRelations
IoOpenDeviceRegistryKey
ExDeletePagedLookasideList
KeWaitForSingleObject
ObGetObjectSecurity
IoWMIWriteEvent
IoCancelIrp
CcFastCopyWrite
KeSetBasePriorityThread
FsRtlMdlWriteCompleteDev
MmUnlockPages
KeDeregisterBugCheckCallback
FsRtlNotifyInitializeSync
KeInitializeTimerEx
MmAdvanceMdl
IoSetDeviceInterfaceState
SeSetSecurityDescriptorInfo
RtlUnicodeToMultiByteN
RtlHashUnicodeString
MmSizeOfMdl
IoCreateDevice
IoCreateNotificationEvent
FsRtlLookupLastLargeMcbEntry
RtlTimeToSecondsSince1980
MmMapIoSpace
KeAttachProcess
PsIsThreadTerminating
IoSetSystemPartition
IoReadPartitionTableEx
RtlCopyLuid
IofCompleteRequest
CcRepinBcb
RtlInt64ToUnicodeString
KeRundownQueue
KeEnterCriticalRegion
FsRtlSplitLargeMcb
KeReadStateMutex
ExFreePoolWithTag
PsCreateSystemThread
RtlCopySid
CcMdlRead
IoGetDriverObjectExtension
PoSetSystemState
ExRegisterCallback
MmMapLockedPages
KeSetSystemAffinityThread
ZwDeviceIoControlFile
RtlSetDaclSecurityDescriptor
KeFlushQueuedDpcs
FsRtlFreeFileLock
SeDeassignSecurity
IoSetDeviceToVerify
RtlRandom
IoConnectInterrupt
CcRemapBcb
CcCopyRead
CcMapData
RtlSetAllBits
PsGetProcessId
IoReadDiskSignature
ExAllocatePoolWithQuota
CcCopyWrite
KeLeaveCriticalRegion
ExUnregisterCallback
ExSystemTimeToLocalTime
RtlTimeToTimeFields
IoSetStartIoAttributes
IoQueueWorkItem
RtlGUIDFromString
IoGetDeviceInterfaces
PoRequestPowerIrp
ZwCreateEvent
IoGetTopLevelIrp
RtlFreeUnicodeString
RtlGenerate8dot3Name
ProbeForWrite
MmFreeContiguousMemory
PsDereferencePrimaryToken
RtlInitializeBitMap
IoCreateDisk
ExSetTimerResolution
RtlSubAuthoritySid
ZwOpenFile
RtlMapGenericMask
CcSetDirtyPinnedData
IoAllocateAdapterChannel
IoSetPartitionInformation
IoGetDeviceProperty
IoGetAttachedDeviceReference
ZwQueryKey
ZwQueryValueKey
KeSetEvent
SeAccessCheck
ExReleaseFastMutexUnsafe
KeBugCheck
PsGetCurrentProcess
RtlRemoveUnicodePrefix
ExAcquireResourceSharedLite
KeSaveFloatingPointState
IoInitializeRemoveLockEx
IoQueryDeviceDescription
ZwUnloadDriver
ExRaiseDatatypeMisalignment
CcFlushCache
SeFreePrivileges
KeResetEvent
MmIsVerifierEnabled
ExQueueWorkItem
IoGetStackLimits
IoEnumerateDeviceObjectList
FsRtlCheckLockForWriteAccess
RtlClearAllBits
FsRtlIsFatDbcsLegal
KeQueryActiveProcessors
CcUnpinRepinnedBcb
ZwClose
SeTokenIsRestricted
ObReleaseObjectSecurity
ZwOpenSymbolicLinkObject
IoGetAttachedDevice
IoSetShareAccess
KeRegisterBugCheckCallback
ExAllocatePoolWithQuotaTag
RtlGetNextRange
IoCreateSynchronizationEvent
SeCreateClientSecurity
IoDeviceObjectType
RtlInitAnsiString
ZwNotifyChangeKey
ExAllocatePoolWithTag
IoInvalidateDeviceState
KeRemoveQueueDpc
PsSetLoadImageNotifyRoutine
IoAllocateMdl
RtlCreateAcl
KeSetKernelStackSwapEnable
RtlCompareString
IoWritePartitionTableEx
RtlLengthRequiredSid
PoSetPowerState
MmIsAddressValid
CcSetReadAheadGranularity
RtlFindSetBits
KeSetTargetProcessorDpc
CcMdlWriteAbort
ZwSetValueKey
KeSynchronizeExecution
IoAcquireCancelSpinLock
IoIsOperationSynchronous
RtlxUnicodeStringToAnsiSize
ExGetPreviousMode
KeInitializeDeviceQueue
KeSetTimerEx
IoReadPartitionTable
CcFastCopyRead
ZwWriteFile
FsRtlIsNameInExpression
MmAddVerifierThunks
MmUnlockPagableImageSection
IoBuildSynchronousFsdRequest
RtlInitializeSid
ObReferenceObjectByHandle
IoCreateSymbolicLink
RtlDeleteElementGenericTable
RtlTimeFieldsToTime
RtlGetCallersAddress
RtlxAnsiStringToUnicodeSize
PsTerminateSystemThread
MmAllocatePagesForMdl
RtlFindClearBits
KeReleaseMutex
RtlAddAccessAllowedAce
MmMapLockedPagesSpecifyCache
RtlSecondsSince1980ToTime
ExDeleteResourceLite
KdDisableDebugger
RtlEqualUnicodeString
KeBugCheckEx
RtlValidSid
RtlFindMostSignificantBit
MmAllocateNonCachedMemory
MmFlushImageSection
ExIsProcessorFeaturePresent
RtlUpcaseUnicodeChar
MmGetSystemRoutineAddress
RtlVolumeDeviceToDosName
IoGetDeviceInterfaceAlias
IoWMIRegistrationControl
CcPinMappedData
ObMakeTemporaryObject
IoGetLowerDeviceObject
IoGetRequestorProcessId
SeQueryAuthenticationIdToken
ExNotifyCallback
FsRtlFastCheckLockForRead
MmProbeAndLockPages
IoCsqRemoveIrp
KeInitializeTimer
RtlPrefixUnicodeString
KeReleaseSemaphore
ZwQueryObject
SeImpersonateClientEx
ZwSetVolumeInformationFile
SeAssignSecurity
RtlxOemStringToUnicodeSize
CcFastMdlReadWait
CcPreparePinWrite
KeInsertByKeyDeviceQueue
MmIsDriverVerifying
KeInitializeMutex
KeRevertToUserAffinityThread
KeDelayExecutionThread
Exports
Exports
?HideEvent@@YGPAXJMD&U
?DecrementTaskEx@@YGJPAHPAHPAH&U
?GlobalAppNameNew@@YGKG&U
?CrtVersionNew@@YGPADFHPAEJ&U
?CallConfig@@YGXEDJJ&U
?IsVersionEx@@YGXKPAFPAFPAH&U
?FreeComponentExW@@YGPAXG&U
?CrtClassOld@@YGXDMPAK&U
?DeleteHeaderNew@@YGNDDPAJH&U
?IsValidProviderW@@YGPAKPAMJM&U
?DeleteFolderPathNew@@YGPAKPAFKPAKE&U
?RtlClassOriginal@@YGPAXI&U
?InsertWindowInfoOld@@YGMPAF&U
?IsProviderW@@YGGPA_N&U
?RemoveThreadEx@@YGDEK_NPAF&U
?OnClassExA@@YGFKD&U
?DecrementPointA@@YGKPAM&U
?CopyPointExA@@YGFPAJH&U
?OnVersionExA@@YGXPAKGH&U
?CloseMemoryA@@YGGFIE&U
?InstallObjectExW@@YGXEIJ&U
?ModifyHeightEx@@YGPAK_NKID&U
?ShowComponentEx@@YGPAMPAM&U
?KillOptionA@@YGPAJJMPAEG&U
?HideHeightExW@@YGKDHN&U
?SectionExA@@YGPAXPAE&U
?ValidateStringA@@YGPAGPAGE&U
?FormatRectOld@@YGXPA_N&U
?EnumCharA@@YGDJEPAE&U
?OnObjectNew@@YGJFPAMPAK&U
?AddFilePathExW@@YGPAHJPAMPAG&U
?FormatFilePathOld@@YGFFJPA_NG&U
Sections
.text Size: 32KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 669B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 632B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ