S:\iIoPvgg\IldsqwlwBgZPro\lyvZBBvA\wycyqpvhvXxvGA.pdb
Static task
static1
Behavioral task
behavioral1
Sample
26188a755933ac9d78778567843544c7_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
26188a755933ac9d78778567843544c7_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
26188a755933ac9d78778567843544c7_JaffaCakes118
-
Size
135KB
-
MD5
26188a755933ac9d78778567843544c7
-
SHA1
a945ab10e11833c39fb1ddc18c2385c8b259641f
-
SHA256
edfca442d6b450ed45d23c120e2f2fbb288dbec017053ebf56f128f722ad4dde
-
SHA512
9cfa595a0ace9ef9efefd48a176b3b0cf52a30265cd4e407325ecf7822e5bf93bf2686b127efcd3e1930e98ff8073d32b9299a068d70e6a5f0d64c22f84550aa
-
SSDEEP
3072:R8e1NFZsndK7GtBnaOAKt0j24z3pGNBFKXU3Wao:Bun87+Vauh4z3wFKX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 26188a755933ac9d78778567843544c7_JaffaCakes118
Files
-
26188a755933ac9d78778567843544c7_JaffaCakes118.dll windows:5 windows x86 arch:x86
94c4880d4988a84c767052877e6f2e6d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeSaveFloatingPointState
RtlCheckRegistryKey
MmBuildMdlForNonPagedPool
RtlValidSecurityDescriptor
SeDeassignSecurity
SeQueryAuthenticationIdToken
RtlUnicodeStringToInteger
IoAllocateWorkItem
RtlMultiByteToUnicodeN
IoReportResourceForDetection
RtlDeleteRegistryValue
IoGetDeviceProperty
RtlEqualSid
RtlCreateSecurityDescriptor
IoBuildSynchronousFsdRequest
RtlQueryRegistryValues
RtlAreBitsSet
IoStartNextPacket
KeInitializeSemaphore
KdEnableDebugger
ZwEnumerateValueKey
RtlCopyString
ExCreateCallback
RtlValidSid
IoGetRequestorProcessId
KeClearEvent
IoDeleteController
ExReleaseFastMutexUnsafe
ExSetTimerResolution
IoGetDeviceInterfaces
IoCreateSymbolicLink
PoRegisterSystemState
IoQueueWorkItem
ZwQueryValueKey
FsRtlCheckLockForReadAccess
ExDeleteNPagedLookasideList
CcSetBcbOwnerPointer
RtlClearAllBits
IoOpenDeviceRegistryKey
KeSynchronizeExecution
ExRaiseDatatypeMisalignment
ExRegisterCallback
SeSinglePrivilegeCheck
FsRtlDeregisterUncProvider
ExVerifySuite
RtlUnicodeToMultiByteN
ExNotifyCallback
PoRequestPowerIrp
CcZeroData
ObGetObjectSecurity
PsGetCurrentProcessId
SeValidSecurityDescriptor
KeRundownQueue
IoReuseIrp
ExAcquireResourceSharedLite
IoGetBootDiskInformation
RtlFindClearBits
RtlInitializeBitMap
RtlInitializeGenericTable
CcFastCopyRead
RtlCreateUnicodeString
MmSetAddressRangeModified
RtlCompareMemory
KeInitializeApc
KeReadStateEvent
ExDeletePagedLookasideList
RtlSubAuthoritySid
PsCreateSystemThread
RtlVerifyVersionInfo
RtlFindMostSignificantBit
IoSetDeviceInterfaceState
KeInitializeQueue
RtlFindClearRuns
ZwMakeTemporaryObject
KeFlushQueuedDpcs
KeCancelTimer
KeRestoreFloatingPointState
MmSizeOfMdl
IoInitializeIrp
RtlUpperString
CcUnpinDataForThread
MmGetSystemRoutineAddress
KeWaitForMultipleObjects
RtlGetNextRange
RtlSetBits
FsRtlIsTotalDeviceFailure
FsRtlIsNameInExpression
RtlCopyLuid
IoFreeWorkItem
IoSetHardErrorOrVerifyDevice
RtlFindUnicodePrefix
FsRtlGetNextFileLock
IoCheckEaBufferValidity
IoCreateNotificationEvent
RtlDeleteNoSplay
RtlRemoveUnicodePrefix
KeReadStateMutex
ExSetResourceOwnerPointer
KeInsertQueueDpc
MmQuerySystemSize
ExGetPreviousMode
IoInvalidateDeviceRelations
CcFastCopyWrite
SeTokenIsRestricted
IoGetDeviceToVerify
IoInitializeTimer
RtlFindClearBitsAndSet
KeSetKernelStackSwapEnable
KeDelayExecutionThread
ExReleaseResourceLite
RtlAnsiStringToUnicodeString
IoAttachDeviceToDeviceStack
RtlCharToInteger
FsRtlSplitLargeMcb
ExGetSharedWaiterCount
RtlUpcaseUnicodeChar
KeQuerySystemTime
SeQueryInformationToken
RtlTimeFieldsToTime
KeUnstackDetachProcess
RtlMapGenericMask
CcIsThereDirtyData
CcRemapBcb
ExRaiseStatus
FsRtlAllocateFileLock
KeSetTimerEx
ZwClose
SeAssignSecurity
FsRtlIsFatDbcsLegal
MmUnlockPagableImageSection
DbgBreakPointWithStatus
RtlUnicodeToOemN
FsRtlIsHpfsDbcsLegal
IoUpdateShareAccess
MmMapIoSpace
FsRtlNotifyInitializeSync
IoAllocateController
IoCancelIrp
KeReleaseSemaphore
RtlTimeToSecondsSince1980
MmIsAddressValid
RtlInitializeSid
IoFreeController
RtlSecondsSince1980ToTime
KdDisableDebugger
RtlSecondsSince1970ToTime
ZwOpenSymbolicLinkObject
KeSetPriorityThread
KeRemoveQueue
RtlLengthSecurityDescriptor
IoMakeAssociatedIrp
KeRemoveDeviceQueue
RtlOemStringToUnicodeString
RtlAppendStringToString
FsRtlIsDbcsInExpression
IoDeviceObjectType
MmAllocateContiguousMemory
PsLookupThreadByThreadId
RtlUpperChar
KeGetCurrentThread
CcDeferWrite
KeSetTimer
RtlClearBits
RtlCopySid
MmCanFileBeTruncated
IoSetThreadHardErrorMode
RtlxUnicodeStringToAnsiSize
MmHighestUserAddress
KeInitializeEvent
RtlInitString
RtlUpcaseUnicodeToOemN
IoStartTimer
PsGetCurrentThreadId
MmGetPhysicalAddress
ZwCreateFile
SeAccessCheck
ObQueryNameString
IoGetStackLimits
MmUnmapLockedPages
RtlNumberOfClearBits
RtlNtStatusToDosError
PoSetPowerState
KeRemoveEntryDeviceQueue
IoRemoveShareAccess
IoRaiseHardError
ZwDeviceIoControlFile
ZwCreateSection
IoRequestDeviceEject
IoCheckShareAccess
RtlHashUnicodeString
KeInsertQueue
FsRtlCheckOplock
ZwQueryVolumeInformationFile
ObCreateObject
IoDeleteDevice
IoCreateFile
KeSetImportanceDpc
ExUnregisterCallback
KeInsertHeadQueue
RtlUnicodeStringToAnsiString
KeDeregisterBugCheckCallback
ExLocalTimeToSystemTime
IoReportDetectedDevice
ZwOpenFile
FsRtlCheckLockForWriteAccess
RtlCompareString
RtlLengthRequiredSid
MmLockPagableDataSection
ZwCreateKey
RtlWriteRegistryValue
CcFastMdlReadWait
CcCopyRead
MmResetDriverPaging
KeBugCheckEx
IoFreeIrp
RtlTimeToTimeFields
KeRegisterBugCheckCallback
FsRtlLookupLastLargeMcbEntry
ZwFreeVirtualMemory
ZwQuerySymbolicLinkObject
IoInvalidateDeviceState
RtlInitAnsiString
KeSetBasePriorityThread
ZwEnumerateKey
PsLookupProcessByProcessId
IoIsWdmVersionAvailable
SeImpersonateClientEx
KeReadStateTimer
ZwQueryObject
ExRaiseAccessViolation
MmFreeNonCachedMemory
RtlFillMemoryUlong
MmSecureVirtualMemory
RtlSetDaclSecurityDescriptor
IoSetSystemPartition
IoBuildPartialMdl
ZwAllocateVirtualMemory
RtlGetVersion
RtlFindSetBits
ExSystemTimeToLocalTime
RtlGUIDFromString
RtlInt64ToUnicodeString
RtlAreBitsClear
RtlFreeAnsiString
RtlInitUnicodeString
ZwOpenKey
KeQueryInterruptTime
IoAllocateIrp
SeDeleteObjectAuditAlarm
KeQueryActiveProcessors
ZwMapViewOfSection
ZwQueryKey
PsGetCurrentThread
ExAllocatePoolWithTag
IoGetAttachedDeviceReference
RtlFindLeastSignificantBit
RtlSetAllBits
KeInitializeTimerEx
Sections
.text Size: 37KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ