P:\urCjBnhSHtX\wbEsYEuLIT\ZkzCruCNLhd\lvhfucomGOj\cfruhhnmCu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
04c8bdd9763436d4e773ac6141191847_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
04c8bdd9763436d4e773ac6141191847_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
04c8bdd9763436d4e773ac6141191847_JaffaCakes118
-
Size
254KB
-
MD5
04c8bdd9763436d4e773ac6141191847
-
SHA1
23ab0ea841a26decdfd44dba86eec3423a956c20
-
SHA256
a126dc4fc9d78b24e8c82f234aafd5467d9daea595b789e65458557c84107835
-
SHA512
a1320dad81be5f5923d0061020d6375a92da0e01eb8be928352d2c867b0173a1b1d73906e2f340cea0eee8aedde1fb5a855dd7e0c0ffa503e3c1854b77f3381b
-
SSDEEP
3072:cFIZkfiqiXuppcsfRmZitFsmxqNQK106ZuC7iDxmY0V7Nw7JFFh610C:AIZk696aSo4O26wC7ms7aJF6+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 04c8bdd9763436d4e773ac6141191847_JaffaCakes118
Files
-
04c8bdd9763436d4e773ac6141191847_JaffaCakes118.dll windows:5 windows x86 arch:x86
3c501d640c6f4659a5cb55eb635efccc
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoInvalidateDeviceState
MmFreeContiguousMemory
KeInitializeApc
IoGetCurrentProcess
RtlTimeToSecondsSince1980
IoConnectInterrupt
IoGetAttachedDevice
CcUnpinRepinnedBcb
RtlSecondsSince1970ToTime
IoVerifyVolume
RtlUpcaseUnicodeString
ProbeForWrite
ZwCreateEvent
KePulseEvent
IoDeviceObjectType
KeSynchronizeExecution
RtlCreateUnicodeString
IoSetSystemPartition
IoRequestDeviceEject
ExAllocatePoolWithQuota
PsSetLoadImageNotifyRoutine
MmAllocatePagesForMdl
IoQueryFileDosDeviceName
IoCreateDevice
KeDeregisterBugCheckCallback
ExRaiseDatatypeMisalignment
SeFreePrivileges
ZwFlushKey
KeGetCurrentThread
SeTokenIsRestricted
MmForceSectionClosed
IoEnumerateDeviceObjectList
ObfDereferenceObject
FsRtlNotifyUninitializeSync
RtlAppendUnicodeToString
IoSetThreadHardErrorMode
IoQueryFileInformation
IoGetBootDiskInformation
RtlUnicodeStringToInteger
RtlIsNameLegalDOS8Dot3
KeDelayExecutionThread
RtlInitUnicodeString
IoThreadToProcess
ZwEnumerateValueKey
CcFastCopyWrite
SeDeleteObjectAuditAlarm
RtlInitializeSid
IoBuildSynchronousFsdRequest
MmFreeMappingAddress
RtlInitializeBitMap
MmFlushImageSection
SeLockSubjectContext
RtlEqualUnicodeString
PsGetCurrentThreadId
RtlQueryRegistryValues
KeRemoveByKeyDeviceQueue
FsRtlGetNextFileLock
KdDisableDebugger
IoSetPartitionInformationEx
PsLookupThreadByThreadId
RtlGUIDFromString
IoAllocateErrorLogEntry
RtlFindClearRuns
CcMdlReadComplete
PsReturnPoolQuota
IoInvalidateDeviceRelations
RtlInt64ToUnicodeString
KeReadStateEvent
RtlFreeAnsiString
RtlUpperChar
RtlFindUnicodePrefix
RtlInsertUnicodePrefix
SeQueryInformationToken
IoSetTopLevelIrp
KeSetSystemAffinityThread
SeAssignSecurity
KeCancelTimer
MmUnlockPagableImageSection
ZwSetVolumeInformationFile
RtlRandom
MmMapLockedPagesSpecifyCache
ExReleaseFastMutexUnsafe
MmFreeNonCachedMemory
ExDeleteNPagedLookasideList
IoDeleteSymbolicLink
PoRegisterSystemState
RtlxAnsiStringToUnicodeSize
MmIsDriverVerifying
ExDeletePagedLookasideList
RtlAddAccessAllowedAceEx
IoQueueWorkItem
KeRevertToUserAffinityThread
RtlMultiByteToUnicodeN
PsRevertToSelf
ZwCreateKey
IoReleaseVpbSpinLock
MmProbeAndLockProcessPages
IoReleaseRemoveLockEx
IoCreateNotificationEvent
RtlCreateSecurityDescriptor
IoReadDiskSignature
IoSetDeviceInterfaceState
KeInsertQueue
RtlxUnicodeStringToAnsiSize
PsLookupProcessByProcessId
RtlCharToInteger
ZwMapViewOfSection
RtlGetCallersAddress
KeQueryActiveProcessors
ExGetExclusiveWaiterCount
IoGetDeviceObjectPointer
RtlCopyLuid
ZwLoadDriver
ObCreateObject
ZwSetSecurityObject
RtlGetVersion
RtlGetNextRange
IoCreateFile
RtlLengthSid
PsGetProcessExitTime
SeReleaseSubjectContext
ExSetTimerResolution
ZwOpenKey
MmIsThisAnNtAsSystem
RtlSetBits
MmIsVerifierEnabled
IoGetDeviceInterfaceAlias
PsImpersonateClient
KeRestoreFloatingPointState
IoCreateDisk
RtlAddAccessAllowedAce
RtlRemoveUnicodePrefix
FsRtlIsDbcsInExpression
CcFlushCache
KeInsertByKeyDeviceQueue
ExSystemTimeToLocalTime
FsRtlDeregisterUncProvider
MmFreePagesFromMdl
PsChargeProcessPoolQuota
KeLeaveCriticalRegion
IoGetLowerDeviceObject
RtlEnumerateGenericTable
KeReleaseMutex
IoAllocateWorkItem
IoGetDiskDeviceObject
RtlInitString
KeSetImportanceDpc
ExRegisterCallback
IoUpdateShareAccess
SePrivilegeCheck
ExFreePoolWithTag
IoReportDetectedDevice
ZwCreateSection
MmUnmapReservedMapping
RtlAnsiCharToUnicodeChar
MmHighestUserAddress
MmAllocateMappingAddress
MmBuildMdlForNonPagedPool
ZwQueryKey
CcRepinBcb
IoRemoveShareAccess
KeInitializeDpc
IoAcquireRemoveLockEx
ZwDeleteValueKey
ZwEnumerateKey
SeSetSecurityDescriptorInfo
RtlAreBitsSet
IoOpenDeviceRegistryKey
ZwOpenFile
RtlSetAllBits
MmLockPagableDataSection
KeAttachProcess
RtlDeleteElementGenericTable
IoIsOperationSynchronous
KeQuerySystemTime
IoQueryDeviceDescription
PoRequestPowerIrp
ExAllocatePoolWithTag
IoCheckQuotaBufferValidity
RtlInitAnsiString
CcFastMdlReadWait
RtlUpperString
CcSetReadAheadGranularity
IoVerifyPartitionTable
KeWaitForMultipleObjects
MmAllocateContiguousMemory
IofCallDriver
ExRaiseStatus
MmSecureVirtualMemory
ExQueueWorkItem
RtlClearAllBits
FsRtlFastUnlockSingle
KefAcquireSpinLockAtDpcLevel
IoDeleteDevice
CcUnpinDataForThread
CcMdlWriteComplete
KeRundownQueue
RtlUnicodeStringToAnsiString
RtlTimeToSecondsSince1970
KeQueryTimeIncrement
ZwFreeVirtualMemory
SeFilterToken
FsRtlCheckOplock
RtlUpcaseUnicodeToOemN
KeInitializeEvent
FsRtlLookupLastLargeMcbEntry
PoCallDriver
KeSetTargetProcessorDpc
IoFreeMdl
KeInsertHeadQueue
SeValidSecurityDescriptor
MmProbeAndLockPages
IoWriteErrorLogEntry
CcInitializeCacheMap
IoStartNextPacket
PsTerminateSystemThread
IoReleaseRemoveLockAndWaitEx
ObMakeTemporaryObject
KeStackAttachProcess
CcFastCopyRead
MmMapIoSpace
SeDeassignSecurity
MmPageEntireDriver
FsRtlFastCheckLockForRead
PoUnregisterSystemState
IoGetRelatedDeviceObject
SeQueryAuthenticationIdToken
CcMdlRead
RtlTimeToTimeFields
KeSetPriorityThread
CcPreparePinWrite
DbgPrompt
FsRtlNotifyInitializeSync
IoInitializeRemoveLockEx
IoStopTimer
MmAdvanceMdl
IoAllocateAdapterChannel
CcPurgeCacheSection
KeWaitForSingleObject
RtlClearBits
ExReleaseResourceLite
IoGetRequestorProcess
RtlAnsiStringToUnicodeString
PsCreateSystemThread
IoGetRequestorProcessId
KeDetachProcess
KeRegisterBugCheckCallback
VerSetConditionMask
CcMdlWriteAbort
RtlFindClearBitsAndSet
MmUnsecureVirtualMemory
IoAllocateIrp
IoVolumeDeviceToDosName
ExAllocatePoolWithQuotaTag
IoFreeErrorLogEntry
ZwQueryValueKey
PsDereferencePrimaryToken
IofCompleteRequest
ProbeForRead
Exports
Exports
?FreeProcess@@IJPAKPAN@X
Sections
.text Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 604B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ