X:\BwlfDpaf\oKixFkpzskhuua\rLrhibrlR\zrAyNjb.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2548b8222122569f6b8e99c52be1098b_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2548b8222122569f6b8e99c52be1098b_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
2548b8222122569f6b8e99c52be1098b_JaffaCakes118
-
Size
227KB
-
MD5
2548b8222122569f6b8e99c52be1098b
-
SHA1
36d703ddb3205861ecab7e15e94228a8a85c6291
-
SHA256
15c99a1f12ab8eff06befde9d6413703b8f202f790b0e1ae3e3ff45aee0c489d
-
SHA512
d38c1d8b4482bdbb6ab50c30dac6f99614c63d8a1221a18a264bd669cc22864f1475b6489b1b9574691d5b1018d52655f20bf8ef8cdd05f312e230145504c535
-
SSDEEP
6144:qnrmNU0d+pEfqtM3WNUeohqqDzwl3erjuTi+1Vw7:qYYmqteEocqHwVTdVw7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2548b8222122569f6b8e99c52be1098b_JaffaCakes118
Files
-
2548b8222122569f6b8e99c52be1098b_JaffaCakes118.dll windows:5 windows x86 arch:x86
459887061f8f35ea1ef3daed22dab48d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeInitializeTimerEx
KePulseEvent
RtlAreBitsClear
ExSetTimerResolution
ZwQueryKey
RtlInitAnsiString
KeSetKernelStackSwapEnable
RtlCompareString
RtlInitUnicodeString
RtlInitString
RtlEqualUnicodeString
ExInitializeResourceLite
FsRtlFreeFileLock
KeUnstackDetachProcess
SeAssignSecurity
RtlFindSetBits
RtlTimeFieldsToTime
KeInitializeSemaphore
RtlUpperString
RtlEqualString
RtlUpcaseUnicodeString
FsRtlIsNameInExpression
RtlxAnsiStringToUnicodeSize
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idat Size: 512B - Virtual size: 96B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 654B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ztest Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stest Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.init Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.srdat Size: 1024B - Virtual size: 697B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 464B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ