d:\_vss\source\Reuse\Drivers\FOPN\FOPN\driver\objfre\i386\FOPN.pdb
Static task
static1
Behavioral task
behavioral1
Sample
0ea3ff689048bfce7660da16e7b75f6d_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0ea3ff689048bfce7660da16e7b75f6d_JaffaCakes118.dll
Resource
win10v2004-20240226-en
General
-
Target
0ea3ff689048bfce7660da16e7b75f6d_JaffaCakes118
-
Size
38KB
-
MD5
0ea3ff689048bfce7660da16e7b75f6d
-
SHA1
47f0a42d9bd6e22097806e823bb9a2d099e6c667
-
SHA256
71add4a2e318280a7261eb959ff4e6a6d31ae7cdc0dffaaf12a7df3169130576
-
SHA512
56a31c1d895abb65246ca82472f01cc0d4d74e8059c170d6ffa7f5800010839d738c5173b782be9a9f0f6a53451f75b29bfccb8d32b8a38a642672b531ef3a96
-
SSDEEP
768:WagLt5cH+FdpIzX//EIFB1tsdViSkgTFEP/sOjYtRS3YkbmdXO:Wa2t564dpsX//EIFBsijPYlO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0ea3ff689048bfce7660da16e7b75f6d_JaffaCakes118
Files
-
0ea3ff689048bfce7660da16e7b75f6d_JaffaCakes118.dll windows:4 windows x86 arch:x86
fb349439bcd35405aa1fcc47684f7321
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ZwSetValueKey
KeDelayExecutionThread
DbgPrint
PsCreateSystemThread
ZwEnumerateValueKey
RtlInitUnicodeString
ZwQueryValueKey
ZwOpenKey
ZwDeleteKey
IofCompleteRequest
IoGetRequestorProcessId
RtlCopyUnicodeString
KeQuerySystemTime
InterlockedExchange
KeServiceDescriptorTable
ZwOpenFile
ZwCreateFile
KeSetEvent
IofCallDriver
KePulseEvent
KeWaitForSingleObject
PsGetCurrentProcessId
IoCancelFileOpen
KeInitializeEvent
ObfDereferenceObject
ObReferenceObjectByHandle
ZwCreateKey
IoAttachDeviceToDeviceStack
ObQueryNameString
ExFreePool
ExAllocatePoolWithTag
ObfReferenceObject
IoDeleteDevice
IoDetachDevice
IoCreateDevice
IoGetDeviceObjectPointer
IoRegisterFsRegistrationChange
IoCreateSymbolicLink
IoRegisterShutdownNotification
DbgBreakPoint
PsSetCreateProcessNotifyRoutine
KeInitializeMutex
ExFreePoolWithTag
KeReleaseMutex
InterlockedDecrement
IoQueryFileInformation
RtlUpcaseUnicodeChar
IoFileObjectType
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwDeleteValueKey
ZwClose
ExQueueWorkItem
InterlockedIncrement
MmGetSystemRoutineAddress
wcslen
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlFreeUnicodeString
hal
ExReleaseFastMutex
KeGetCurrentIrql
ExAcquireFastMutex
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 872B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ