O:\UOxGhqqJeuT\TjrnAnanJmZyV\ryzxozkNh\TqrgKwmyvCreAe.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1aa32516cefe224476ec7c00df866670_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1aa32516cefe224476ec7c00df866670_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
1aa32516cefe224476ec7c00df866670_JaffaCakes118
-
Size
331KB
-
MD5
1aa32516cefe224476ec7c00df866670
-
SHA1
afc6b4ea37ff0f2e82f234944aab35c0fb463aea
-
SHA256
561f122779af3b09fb17f8ef1cefe4087fdafce3ebcad0bfbeb286c83429b417
-
SHA512
8978ac7defd8707ec4c3443abe1ae88efb41e43e4545c963396333a231c8b7bb5be0dc22e74715ca0514ef57e8aa425d058c79df108e38dd2eb3251a70921bf7
-
SSDEEP
6144:7A1R0BlX19ow6KWgtaNI5BE5gQ5yxW/GAOa98grg08BkQ2dWihh1IDm:LB19UK0fgQ52kGRZKQK4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1aa32516cefe224476ec7c00df866670_JaffaCakes118
Files
-
1aa32516cefe224476ec7c00df866670_JaffaCakes118.dll windows:5 windows x86 arch:x86
78a647504dc0a8b45c9c4131f0dc86e2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeQueryTimeIncrement
PoUnregisterSystemState
KeStackAttachProcess
RtlxAnsiStringToUnicodeSize
RtlInitUnicodeString
RtlxUnicodeStringToAnsiSize
ExReleaseFastMutexUnsafe
ZwCreateFile
RtlTimeToTimeFields
KeEnterCriticalRegion
KeSetKernelStackSwapEnable
RtlInitAnsiString
RtlEqualUnicodeString
ZwOpenFile
KeInitializeTimer
RtlEqualString
RtlAnsiCharToUnicodeChar
RtlUpperChar
KeRemoveEntryDeviceQueue
ExSetTimerResolution
ExIsProcessorFeaturePresent
RtlInitString
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idat Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 662B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ztest Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stest Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.init Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.srdat Size: 1024B - Virtual size: 748B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 528B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ