C:\KvOosu\ljyIw\wgvImrv\cvbq\plqyWYCH.pdb
Static task
static1
Behavioral task
behavioral1
Sample
23121154ad6e1a5dc6232fdeb3c0f78a_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
23121154ad6e1a5dc6232fdeb3c0f78a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
23121154ad6e1a5dc6232fdeb3c0f78a_JaffaCakes118
-
Size
35KB
-
MD5
23121154ad6e1a5dc6232fdeb3c0f78a
-
SHA1
9b884cc85c2ab6bb2a5239fb7edeebf6061a04b2
-
SHA256
af080673b3688782027ebd9c36dc1abeeb8b1d43aebe9c3cc91106f21003b034
-
SHA512
4c57d30d8e84dd334f3d078576457f4df7e6bdfcba0ea19cf3ebf45e4ed5c31a9baeda74a84040a3411781c0851310cf366a07e300a3fef9850c50173d7e8438
-
SSDEEP
768:ASjKnisRD2HfKKuGRBYdkCvHbQtSHMqUi:XWiZREiC8tSsq7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 23121154ad6e1a5dc6232fdeb3c0f78a_JaffaCakes118
Files
-
23121154ad6e1a5dc6232fdeb3c0f78a_JaffaCakes118.dll windows:5 windows x86 arch:x86
85cb6dda1eb441fc7e6daf0588454075
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ExIsProcessorFeaturePresent
RtlEqualString
FsRtlDeregisterUncProvider
KeInitializeSpinLock
IoRemoveShareAccess
IoUpdateShareAccess
KeCancelTimer
RtlCreateRegistryKey
KeReadStateMutex
RtlCopySid
RtlInitString
MmUnlockPagableImageSection
RtlUnicodeToMultiByteN
IoGetAttachedDeviceReference
atoi
RtlFillMemoryUlong
ProbeForRead
RtlCompareString
MmQuerySystemSize
KeInsertQueue
RtlCopyLuid
RtlAreBitsSet
RtlFindSetBits
IoGetDeviceToVerify
IoAcquireCancelSpinLock
MmUnsecureVirtualMemory
Exports
Exports
?xehznsxLaXeg@@YGMH@Z
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 860B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.INIT Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ