I:\QhrXJcrmLu\wlciTgatCxt\pOhmkbd\oaeCknLzvvxbbz.pdb
Static task
static1
Behavioral task
behavioral1
Sample
09d2c4fe692b18e0474a3f22abc66461_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
09d2c4fe692b18e0474a3f22abc66461_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
09d2c4fe692b18e0474a3f22abc66461_JaffaCakes118
-
Size
176KB
-
MD5
09d2c4fe692b18e0474a3f22abc66461
-
SHA1
e1f246aefde9c941e11ea171722a07ad96c14b2e
-
SHA256
857d8d6d70610211b54fa132ed6c3adaa7feebd985e3a10a09309cce6d26a5e1
-
SHA512
5bfb988c215a0c279c2fdc68148aa9989ff82a6c445ac3cd81d015d438a70b4f141657f44cede789b7a1da41cc422c78da631e168430bfa8910874f1318bf9f1
-
SSDEEP
3072:sWM0ZOWUAoicSn+j5tjSiGI138IyyLv9HK4ef5RQRn99IFxDlb:sWM0ZKu+MIZXLy6ni
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 09d2c4fe692b18e0474a3f22abc66461_JaffaCakes118
Files
-
09d2c4fe692b18e0474a3f22abc66461_JaffaCakes118.dll windows:5 windows x86 arch:x86
c0250e7604aa53f6f32a7fb6ea92873b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ZwCreateFile
RtlInitString
RtlSetBits
FsRtlIsNameInExpression
FsRtlDeregisterUncProvider
RtlInitializeGenericTable
RtlEnumerateGenericTable
IoGetDriverObjectExtension
IoGetRequestorProcessId
ObQueryNameString
RtlUpcaseUnicodeString
RtlEqualString
FsRtlCheckOplock
RtlEqualUnicodeString
RtlUnicodeToMultiByteN
RtlCompareString
RtlUpperChar
RtlIntegerToUnicodeString
RtlInitUnicodeString
SeAssignSecurity
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ