H:\gjdsbkovKz\qbneyMuluhxd\WAowuqxMv\rZmftmjw\rbXbTaUWbLg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
1afde62ea851480ce23ea7e1593cef02_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1afde62ea851480ce23ea7e1593cef02_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
1afde62ea851480ce23ea7e1593cef02_JaffaCakes118
-
Size
443KB
-
MD5
1afde62ea851480ce23ea7e1593cef02
-
SHA1
a5f0e78965eed84fa11723d5075051fb46355c95
-
SHA256
7f18472b1116865a8a5a096576f4420e83266eadf284876356cf50ddd0764b01
-
SHA512
36a4e3f4249d277f715598298d68d36ed56e4e53100b497aeb71a251444e5316fe1b883a721c72bd13aa5fb8a87756e89b0e7804580ca9ef5339cf95d0b5f992
-
SSDEEP
6144:IaUcndlnJfTf4A96Vid9szw77k6M8i1cES128JV3Lk1q13+pKSSFxi8d0Q7kTUxf:Ecndlh/s0MO128JtpuY9ccSI8tAZH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 1afde62ea851480ce23ea7e1593cef02_JaffaCakes118
Files
-
1afde62ea851480ce23ea7e1593cef02_JaffaCakes118.dll windows:5 windows x86 arch:x86
2f4c623c3b89ac5a6aa334099cb644b2
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeStackAttachProcess
IoDisconnectInterrupt
RtlValidSid
SePrivilegeCheck
DbgPrompt
IoGetDeviceObjectPointer
KeSetEvent
SeValidSecurityDescriptor
PoCallDriver
RtlNumberOfClearBits
ZwFsControlFile
PsReturnPoolQuota
RtlCreateUnicodeString
FsRtlDeregisterUncProvider
CcCanIWrite
CcMdlWriteAbort
KeDetachProcess
CcMapData
MmAdvanceMdl
MmAllocateContiguousMemory
RtlAddAccessAllowedAceEx
SeAssignSecurity
KdEnableDebugger
IoFreeController
ExReinitializeResourceLite
ExDeleteNPagedLookasideList
ZwPowerInformation
KeSetTimerEx
RtlAreBitsClear
KeDeregisterBugCheckCallback
RtlAnsiCharToUnicodeChar
IoInvalidateDeviceState
CcRepinBcb
MmUnmapIoSpace
MmBuildMdlForNonPagedPool
FsRtlSplitLargeMcb
PsGetProcessId
IoStartNextPacket
KeInitializeApc
ZwReadFile
KeCancelTimer
MmUnlockPages
ZwMapViewOfSection
MmSizeOfMdl
IoGetStackLimits
ZwWriteFile
RtlCompareString
IoQueryFileInformation
PsGetCurrentThreadId
ObCreateObject
IoReleaseRemoveLockEx
MmCanFileBeTruncated
CcFastMdlReadWait
PsReferencePrimaryToken
IoSetPartitionInformation
ExDeletePagedLookasideList
RtlSetBits
RtlUpcaseUnicodeChar
IoCreateDisk
KePulseEvent
CcSetDirtyPinnedData
PsGetCurrentThread
ZwOpenSection
RtlSecondsSince1970ToTime
IoGetTopLevelIrp
ZwQueryInformationFile
ExVerifySuite
RtlValidSecurityDescriptor
RtlInitAnsiString
RtlSplay
RtlxOemStringToUnicodeSize
CcCopyWrite
FsRtlLookupLastLargeMcbEntry
SeSinglePrivilegeCheck
IoBuildPartialMdl
RtlFindClearBits
CcPreparePinWrite
IoDeleteController
RtlLengthSecurityDescriptor
IoStopTimer
IoCsqRemoveIrp
PsGetCurrentProcess
KeRemoveEntryDeviceQueue
MmFreePagesFromMdl
FsRtlNotifyInitializeSync
RtlMultiByteToUnicodeN
RtlEqualString
SeSetSecurityDescriptorInfo
PsGetCurrentProcessId
KeInitializeEvent
MmMapLockedPagesSpecifyCache
PoStartNextPowerIrp
ZwSetValueKey
IoAllocateWorkItem
ZwDeviceIoControlFile
IoQueryDeviceDescription
RtlMapGenericMask
FsRtlCheckLockForWriteAccess
SeFilterToken
ObOpenObjectByPointer
IoGetDeviceInterfaces
RtlCopyUnicodeString
MmUnmapLockedPages
RtlxAnsiStringToUnicodeSize
KeInitializeTimerEx
IoSetHardErrorOrVerifyDevice
KeDelayExecutionThread
IoAllocateErrorLogEntry
FsRtlFastUnlockSingle
VerSetConditionMask
ObfDereferenceObject
RtlGetVersion
KeWaitForMultipleObjects
SeAppendPrivileges
RtlxUnicodeStringToAnsiSize
RtlEnumerateGenericTable
SeQueryInformationToken
ZwFlushKey
MmIsVerifierEnabled
SeAccessCheck
FsRtlCheckLockForReadAccess
DbgBreakPointWithStatus
IoReportDetectedDevice
ExRaiseDatatypeMisalignment
ZwSetVolumeInformationFile
PoUnregisterSystemState
RtlIntegerToUnicodeString
IoGetDiskDeviceObject
IoFreeErrorLogEntry
IoSetDeviceInterfaceState
PsGetThreadProcessId
PsSetLoadImageNotifyRoutine
RtlTimeFieldsToTime
ExFreePoolWithTag
KeRundownQueue
ExSetResourceOwnerPointer
KeInitializeMutex
KeQueryActiveProcessors
IoInitializeIrp
ProbeForWrite
ExGetSharedWaiterCount
ExRaiseAccessViolation
IoCreateDevice
PsDereferencePrimaryToken
IoIsWdmVersionAvailable
IoGetDeviceProperty
RtlFindSetBits
ObQueryNameString
RtlOemStringToUnicodeString
CcSetBcbOwnerPointer
IoSetPartitionInformationEx
KeSetTimer
KeInsertByKeyDeviceQueue
IoUnregisterFileSystem
CcMdlRead
KeFlushQueuedDpcs
IoAcquireCancelSpinLock
FsRtlNotifyUninitializeSync
KeRemoveQueueDpc
IoStartTimer
RtlCheckRegistryKey
IoFreeIrp
ZwEnumerateValueKey
ObReleaseObjectSecurity
CcRemapBcb
MmForceSectionClosed
IoUpdateShareAccess
IoDeleteSymbolicLink
KeRestoreFloatingPointState
RtlRandom
MmAddVerifierThunks
IoFreeMdl
MmProbeAndLockPages
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
ZwOpenSymbolicLinkObject
KeAttachProcess
RtlStringFromGUID
IoGetDeviceAttachmentBaseRef
IoVerifyPartitionTable
IoReleaseCancelSpinLock
RtlAnsiStringToUnicodeString
RtlWriteRegistryValue
KeInitializeDeviceQueue
RtlAppendUnicodeToString
SeOpenObjectAuditAlarm
RtlFindClearRuns
ExFreePool
IoVolumeDeviceToDosName
ExAcquireResourceSharedLite
RtlDeleteElementGenericTable
RtlUpcaseUnicodeString
KeUnstackDetachProcess
RtlUpperString
KeReadStateTimer
ZwMakeTemporaryObject
IoGetAttachedDevice
KeSetKernelStackSwapEnable
IoGetRequestorProcess
DbgBreakPoint
RtlGUIDFromString
IoDeviceObjectType
SeDeassignSecurity
ZwCreateFile
IoAllocateAdapterChannel
RtlCopyLuid
SeTokenIsRestricted
IoGetDriverObjectExtension
ZwOpenKey
RtlTimeToSecondsSince1970
ZwClose
KeReleaseMutex
ExIsProcessorFeaturePresent
KeGetCurrentThread
CcInitializeCacheMap
ZwCreateEvent
RtlInitializeUnicodePrefix
IoReuseIrp
PoRequestPowerIrp
RtlOemToUnicodeN
IoDetachDevice
RtlVolumeDeviceToDosName
RtlFindUnicodePrefix
IoThreadToProcess
RtlFindMostSignificantBit
RtlInt64ToUnicodeString
MmSecureVirtualMemory
MmIsDriverVerifying
KeInsertHeadQueue
MmMapIoSpace
KeQueryInterruptTime
RtlClearAllBits
ExGetExclusiveWaiterCount
KeRegisterBugCheckCallback
RtlCopySid
PsGetProcessExitTime
CcUninitializeCacheMap
IoReadPartitionTableEx
CcFastCopyWrite
RtlRemoveUnicodePrefix
KdDisableDebugger
MmMapUserAddressesToPage
RtlFindClearBitsAndSet
MmUnlockPagableImageSection
RtlCharToInteger
ZwNotifyChangeKey
RtlUnicodeToOemN
KeSynchronizeExecution
RtlFreeAnsiString
RtlFindLeastSignificantBit
MmGetSystemRoutineAddress
RtlHashUnicodeString
RtlClearBits
KeSetImportanceDpc
RtlSubAuthoritySid
RtlInitUnicodeString
IoInvalidateDeviceRelations
RtlExtendedIntegerMultiply
ExLocalTimeToSystemTime
IoSetShareAccess
ObGetObjectSecurity
PsChargeProcessPoolQuota
ExSystemTimeToLocalTime
IoCreateFile
Exports
Exports
?IncrementPathExA@@YGEHGF&U
?SetScreenW@@YGEEF&U
?PutDateTimeEx@@YGJFPA_NE&U
?AddHeaderExA@@YGXG&U
?TextExA@@YGHPAJPAG&U
?ProcessExW@@YGPAGNPANPADPAG&U
?FreeFolderPathEx@@YGKKJHG&U
?DecrementObjectNew@@YGPAIINEPAK&U
?RtlSystemW@@YGPAMEKI&U
?IsNotSizeW@@YGXIPAF&U
?RemoveFunction@@YGPA_NHPAK&U
?GenerateKeyboardA@@YGXF&U
?RemoveKeyboardEx@@YGHKDJN&U
?FindKeyNameEx@@YGND&U
?CloseCharOriginal@@YGXPAJ&U
?Section@@YGPAEG&U
?KillDirectory@@YGFDPAG&U
?DecrementDialogEx@@YGPAGPAH&U
?ShowFunction@@YGPAXJ&U
?ShowValueA@@YGPAEN&U
?DeleteFullName@@YGXHPAH&U
?EnumClassNew@@YGKPAI_N&U
?ClosePathExA@@YGIHGK_N&U
?CallModuleOld@@YGKGH&U
?IsValidDialogNew@@YGKGPA_N&U
?CloseWindowInfoOld@@YGPAIHGDG&U
?SetEventOriginal@@YGPAHKDPAH&U
?GlobalFunctionEx@@YGIPAFK&U
?EnumPenA@@YGJGPAJE&U
?CopyDialogExA@@YGPAMPAIMIJ&U
?AddWidthA@@YG_NJHM&U
?SetDateTimeEx@@YGGKGPAH&U
?InvalidateFilePathOld@@YGPANPAHPAFI&U
?AddProviderW@@YGMEMPAF&U
?CopyDateTimeExW@@YGPAGPADMEE&U
?ValidateFolderEx@@YGPAJEJIJ&U
?RtlKeyboardW@@YGEM&U
?FreeProcessExW@@YGK_NKPAH&U
Sections
.text Size: 27KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 713B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ