Y:\qyqeiQplho\hfbLlvk\knVhusi\nshIhyaybG\rCAfxMfBBic.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2739f582f3a30c75021048ab1c019dde_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2739f582f3a30c75021048ab1c019dde_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2739f582f3a30c75021048ab1c019dde_JaffaCakes118
-
Size
61KB
-
MD5
2739f582f3a30c75021048ab1c019dde
-
SHA1
b09261e6fd4a0023477c8d26707199309d48467c
-
SHA256
9aec63b891a7b004de98e70b06b34853fa3cb818d807bdc1ef2ff31bcf3100d7
-
SHA512
9ff8037993112d7a88e7935fa32618d9f3936ddb33acccf14893b9dd467e1551536860e0078279dbef53395c61cf1907ce8dae9bef1cbf733cc2cc5ca8945413
-
SSDEEP
1536:lD3qFTysVIUYrP/N5mousWmdke/G6NC2Jej0dR:0lysVID7/eorWmdpG6NC2Jej0dR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2739f582f3a30c75021048ab1c019dde_JaffaCakes118
Files
-
2739f582f3a30c75021048ab1c019dde_JaffaCakes118.dll windows:5 windows x86 arch:x86
abdfeab1f19712bdb0872e15ff61dc55
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoIsWdmVersionAvailable
KeSetSystemAffinityThread
IoDeleteDevice
KeResetEvent
IoAllocateMdl
IoAllocateController
RtlCreateSecurityDescriptor
IoRemoveShareAccess
ExGetSharedWaiterCount
ExCreateCallback
ZwCreateDirectoryObject
MmIsThisAnNtAsSystem
KeInitializeTimer
PoRequestPowerIrp
ZwQueryObject
ZwReadFile
ZwSetSecurityObject
MmMapIoSpace
ZwOpenFile
RtlCompareMemory
RtlIntegerToUnicodeString
RtlCompareUnicodeString
RtlInitAnsiString
ZwUnloadDriver
IoQueryFileDosDeviceName
DbgBreakPointWithStatus
RtlWriteRegistryValue
MmProbeAndLockPages
IoCsqRemoveIrp
PoSetSystemState
MmSizeOfMdl
PsChargeProcessPoolQuota
MmAllocatePagesForMdl
KeInsertDeviceQueue
IoGetRequestorProcessId
ExDeleteResourceLite
SeCaptureSubjectContext
RtlFreeUnicodeString
RtlUnicodeStringToAnsiString
RtlUnicodeToOemN
RtlEqualSid
CcMdlWriteComplete
IoBuildSynchronousFsdRequest
SePrivilegeCheck
KeLeaveCriticalRegion
CcMapData
KePulseEvent
CcCanIWrite
MmMapUserAddressesToPage
MmFreeMappingAddress
ObQueryNameString
RtlAddAccessAllowedAceEx
FsRtlDeregisterUncProvider
RtlPrefixUnicodeString
ZwOpenKey
MmIsVerifierEnabled
CcZeroData
SeImpersonateClientEx
IoGetBootDiskInformation
RtlCopyString
HalExamineMBR
MmAdvanceMdl
IoRequestDeviceEject
IoReportResourceForDetection
ExAcquireResourceSharedLite
RtlDelete
MmUnmapIoSpace
ZwWriteFile
IoCheckEaBufferValidity
CcFlushCache
KeSetEvent
PsLookupThreadByThreadId
MmUnmapLockedPages
ObfReferenceObject
RtlOemToUnicodeN
IoGetDeviceObjectPointer
ExNotifyCallback
KeQueryTimeIncrement
RtlInitializeBitMap
MmAllocateNonCachedMemory
PsGetCurrentThreadId
CcPinMappedData
PoSetPowerState
KeReleaseSemaphore
ProbeForWrite
SeFreePrivileges
PsLookupProcessByProcessId
ExIsProcessorFeaturePresent
RtlVerifyVersionInfo
MmResetDriverPaging
ExVerifySuite
IoGetDeviceProperty
IoGetRequestorProcess
MmMapLockedPagesSpecifyCache
KeQueryInterruptTime
FsRtlCheckLockForReadAccess
RtlInitializeGenericTable
CcPinRead
IoAllocateErrorLogEntry
ZwDeleteKey
RtlGenerate8dot3Name
IofCompleteRequest
MmCanFileBeTruncated
WmiQueryTraceInformation
ZwQueryKey
KdDisableDebugger
RtlAreBitsClear
SeQueryAuthenticationIdToken
KeInitializeDpc
RtlFindClearBitsAndSet
SeQueryInformationToken
SeReleaseSubjectContext
ProbeForRead
KeRemoveByKeyDeviceQueue
RtlInitString
MmUnlockPages
KefAcquireSpinLockAtDpcLevel
RtlEnumerateGenericTable
IoInvalidateDeviceState
RtlSetBits
MmFreeContiguousMemory
IoStartNextPacket
RtlUnicodeToMultiByteN
KeInsertByKeyDeviceQueue
ObMakeTemporaryObject
KeFlushQueuedDpcs
PsGetCurrentThread
IoAcquireRemoveLockEx
SeFilterToken
MmHighestUserAddress
ExReleaseResourceLite
IoWritePartitionTableEx
RtlFreeOemString
ZwCreateSection
FsRtlIsDbcsInExpression
FsRtlFastUnlockSingle
KeInsertQueue
IoDisconnectInterrupt
KeDeregisterBugCheckCallback
RtlHashUnicodeString
MmUnlockPagableImageSection
ZwQueryValueKey
RtlStringFromGUID
KeRestoreFloatingPointState
ZwOpenSection
MmAllocateContiguousMemory
IoReadPartitionTable
ExUnregisterCallback
IoUnregisterFileSystem
ExUuidCreate
KeBugCheckEx
ZwSetVolumeInformationFile
IoSetTopLevelIrp
IoCreateFile
PsSetLoadImageNotifyRoutine
CcFastCopyRead
RtlSetDaclSecurityDescriptor
FsRtlMdlWriteCompleteDev
IoRegisterFileSystem
RtlUpcaseUnicodeChar
KeRundownQueue
IoGetDeviceAttachmentBaseRef
IoDeviceObjectType
IoSetThreadHardErrorMode
RtlOemStringToUnicodeString
RtlCreateRegistryKey
IoDetachDevice
ExLocalTimeToSystemTime
IoSetDeviceToVerify
IoGetDmaAdapter
ExAcquireFastMutexUnsafe
RtlSubAuthoritySid
MmLockPagableDataSection
ZwSetValueKey
VerSetConditionMask
ExRegisterCallback
IoGetRelatedDeviceObject
ExSystemTimeToLocalTime
CcCopyWrite
ExReinitializeResourceLite
ZwFreeVirtualMemory
RtlExtendedIntegerMultiply
CcUnpinDataForThread
IoVolumeDeviceToDosName
RtlAnsiCharToUnicodeChar
IoBuildPartialMdl
ExQueueWorkItem
CcDeferWrite
MmAllocateMappingAddress
RtlFindClearBits
RtlAppendUnicodeToString
ZwEnumerateKey
ZwDeviceIoControlFile
IoGetCurrentProcess
RtlDeleteNoSplay
SeDeassignSecurity
RtlRemoveUnicodePrefix
KeQueryActiveProcessors
CcUnpinRepinnedBcb
ObOpenObjectByPointer
RtlxOemStringToUnicodeSize
RtlLengthSecurityDescriptor
IoGetStackLimits
RtlDeleteRegistryValue
CcSetFileSizes
RtlRandom
IoGetDeviceToVerify
RtlSecondsSince1970ToTime
IoInitializeTimer
FsRtlIsTotalDeviceFailure
RtlInt64ToUnicodeString
FsRtlCheckLockForWriteAccess
IoConnectInterrupt
KeInitializeEvent
CcUnpinData
ExInitializeResourceLite
IoMakeAssociatedIrp
KeSetImportanceDpc
IoCreateSynchronizationEvent
RtlSetAllBits
ObInsertObject
KeInitializeMutex
ObReleaseObjectSecurity
IoSetStartIoAttributes
KeQuerySystemTime
KeReadStateMutex
IoGetAttachedDeviceReference
SeDeleteObjectAuditAlarm
RtlLengthSid
IoGetAttachedDevice
KeWaitForSingleObject
ObReferenceObjectByHandle
MmBuildMdlForNonPagedPool
IoAllocateAdapterChannel
IoInitializeRemoveLockEx
IoOpenDeviceRegistryKey
RtlUpperChar
IoCreateSymbolicLink
IoIsSystemThread
ZwOpenProcess
RtlInitializeUnicodePrefix
ExGetExclusiveWaiterCount
IoSetHardErrorOrVerifyDevice
KeSynchronizeExecution
RtlAppendStringToString
RtlGetCallersAddress
RtlEqualString
RtlMultiByteToUnicodeN
PsImpersonateClient
RtlGetNextRange
ExFreePoolWithTag
CcCopyRead
RtlFindClearRuns
MmGetSystemRoutineAddress
PsReferencePrimaryToken
IoRaiseHardError
KeReadStateEvent
RtlxAnsiStringToUnicodeSize
KeInsertHeadQueue
Exports
Exports
?ModifyDateEx@@YGXKPAJFI&U
?InstallFileA@@YGXGPADPAI&U
?CrtListOriginal@@YGPA_NPAD&U
?CrtStateNew@@YGIPAH&U
?ValidateMutantOriginal@@YGMG&U
?KillHeaderA@@YGPAKG&U
?RemoveMessageW@@YGFJEKI&U
?CloseProcessA@@YGXJPA_N&U
?CrtObject@@YGJPADGMJ&U
?KillClassA@@YGXKHM&U
?IncrementWindowExA@@YGEPADKF_N&U
?GetProviderOld@@YGDMJ&U
?ModifyValueExW@@YGPAIPAEEH&U
?CharNew@@YGIEIPAM&U
?CopyDateTimeW@@YGFFPAJ&U
?RtlMutant@@YGMGPAGJPAH&U
?FindPathNew@@YGXFPAIHH&U
?ShowArgumentA@@YGEFHE&U
?CopyCharEx@@YGHIDPAH&U
?DeleteMutantOriginal@@YGJKPA_N&U
?SetFilePathExW@@YGPADJPAD&U
?EnumConfigExW@@YGXPAEJPAK&U
?OnPenExA@@YGPAGI&U
?GenerateCharW@@YGKPAHDPAN_N&U
?CrtVersionOld@@YGPAEDI&U
?CallMemoryA@@YGGI&U
?PutProjectExA@@YGKE&U
?DecrementStateEx@@YGPAJPAEJ&U
?CloseFileExA@@YGPAFE&U
?CloseTextEx@@YGPAIGJPAKJ&U
?RtlClassExA@@YGJEDPAI&U
?RtlCommandLineW@@YGGDPAHNK&U
Sections
.text Size: 29KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 294B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 692B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ