O:\ogvfwdTec\ohlswEalwuk\dtVyBpL\DoGoCxumZq\iLokfymRp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
27bb7c66d35cf55bc9a6f06e592260be_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
27bb7c66d35cf55bc9a6f06e592260be_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
27bb7c66d35cf55bc9a6f06e592260be_JaffaCakes118
-
Size
106KB
-
MD5
27bb7c66d35cf55bc9a6f06e592260be
-
SHA1
e55f011cfc03a0e5251de109b13e364e1124c36b
-
SHA256
e9aef02443d1b28d0389c9f26ae091632e7b2f88fbfbe529c7468d3cf81fcdd8
-
SHA512
b39b0d9db3fcd896c58c7e15427b8274ab055576993b31ea2df2845aee7afe4ad79fe7d33020a158bc161bebf844c0f66e48979df9ad634d198634cdef28a092
-
SSDEEP
768:5x/eKk1VME8fKi93omVX3Mi2eYPkJ7W0MgUA2xoolYpCObQqNn25BxjOLunnLv8Y:Dv9fKGX3SkJ7W0DilObVn+KuwqjEwy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27bb7c66d35cf55bc9a6f06e592260be_JaffaCakes118
Files
-
27bb7c66d35cf55bc9a6f06e592260be_JaffaCakes118.dll windows:5 windows x86 arch:x86
8a35dd6e99e4feaceacc5ef115888649
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ExFreePoolWithTag
IoInvalidateDeviceRelations
IoSetDeviceInterfaceState
ZwDeleteKey
KeRestoreFloatingPointState
ZwOpenFile
IoGetDriverObjectExtension
RtlVerifyVersionInfo
IoGetDmaAdapter
RtlSecondsSince1970ToTime
KeEnterCriticalRegion
PsDereferencePrimaryToken
KeBugCheck
CcFastMdlReadWait
KeRundownQueue
KeSetPriorityThread
RtlQueryRegistryValues
ExGetExclusiveWaiterCount
ObReferenceObjectByPointer
ZwQueryValueKey
MmSizeOfMdl
KeReadStateSemaphore
MmUnmapLockedPages
KeGetCurrentThread
RtlFindMostSignificantBit
KeInitializeDeviceQueue
ExReinitializeResourceLite
KeWaitForMultipleObjects
IoReportDetectedDevice
RtlSubAuthoritySid
IoMakeAssociatedIrp
RtlRemoveUnicodePrefix
SeDeleteObjectAuditAlarm
IoRemoveShareAccess
IoAllocateMdl
RtlCopyString
ExRaiseAccessViolation
IoStartNextPacket
CcCopyWrite
IoDeleteController
KeRemoveQueueDpc
FsRtlCheckLockForWriteAccess
KeStackAttachProcess
SeOpenObjectAuditAlarm
MmBuildMdlForNonPagedPool
IoSetHardErrorOrVerifyDevice
ExRaiseDatatypeMisalignment
IoAllocateController
RtlInitAnsiString
KeUnstackDetachProcess
KeSetImportanceDpc
IoCancelIrp
FsRtlGetNextFileLock
RtlInsertUnicodePrefix
PsGetCurrentThread
KeSetBasePriorityThread
KeInsertDeviceQueue
PsLookupThreadByThreadId
ExAllocatePoolWithQuotaTag
SeAccessCheck
ZwDeviceIoControlFile
MmFreeContiguousMemory
RtlTimeToTimeFields
CcDeferWrite
IoStopTimer
IoGetDeviceToVerify
MmProbeAndLockPages
RtlEnumerateGenericTable
ZwQueryInformationFile
RtlCheckRegistryKey
ZwOpenProcess
PoUnregisterSystemState
KeSetTimer
RtlCompareUnicodeString
IoStartPacket
RtlTimeToSecondsSince1980
PsIsThreadTerminating
IoGetRelatedDeviceObject
ZwReadFile
RtlAreBitsClear
ExDeletePagedLookasideList
MmSetAddressRangeModified
KePulseEvent
ExAcquireResourceSharedLite
IoGetAttachedDeviceReference
FsRtlIsNameInExpression
ExUuidCreate
PoSetPowerState
SeTokenIsAdmin
KeBugCheckEx
IoIsWdmVersionAvailable
RtlTimeToSecondsSince1970
MmUnmapIoSpace
MmCanFileBeTruncated
IoGetDeviceProperty
IoAcquireCancelSpinLock
IoConnectInterrupt
ZwOpenSymbolicLinkObject
MmMapLockedPagesSpecifyCache
IoGetAttachedDevice
FsRtlCheckOplock
FsRtlIsDbcsInExpression
ObQueryNameString
CcUnpinDataForThread
MmUnsecureVirtualMemory
SeValidSecurityDescriptor
SeAssignSecurity
ZwFsControlFile
KeInsertQueueDpc
KeQueryInterruptTime
MmSecureVirtualMemory
ExGetSharedWaiterCount
RtlCharToInteger
KeReadStateTimer
IoRequestDeviceEject
KeClearEvent
ZwDeleteValueKey
IoAllocateIrp
IoCheckEaBufferValidity
ExRegisterCallback
KeSetEvent
KeWaitForSingleObject
IoSetThreadHardErrorMode
ExIsProcessorFeaturePresent
KeReleaseSemaphore
CcFastCopyRead
IoOpenDeviceRegistryKey
RtlInitString
IoReuseIrp
KeRegisterBugCheckCallback
MmLockPagableSectionByHandle
RtlInitializeUnicodePrefix
IoDeleteDevice
KeInsertByKeyDeviceQueue
MmGetSystemRoutineAddress
RtlLengthSecurityDescriptor
PsGetVersion
KeInitializeTimer
RtlDowncaseUnicodeString
KeQueryTimeIncrement
RtlFindNextForwardRunClear
MmQuerySystemSize
RtlAreBitsSet
IoDetachDevice
ZwCreateKey
RtlAnsiCharToUnicodeChar
ObReleaseObjectSecurity
MmAllocateNonCachedMemory
RtlFreeAnsiString
IoCreateStreamFileObjectLite
ExRaiseStatus
ZwOpenKey
RtlUnicodeStringToAnsiString
RtlNumberOfClearBits
RtlFindLastBackwardRunClear
RtlFillMemoryUlong
IoCreateSymbolicLink
RtlInt64ToUnicodeString
RtlCreateSecurityDescriptor
RtlAppendStringToString
ExSystemTimeToLocalTime
IoSetShareAccess
KdEnableDebugger
IoCheckQuotaBufferValidity
FsRtlAllocateFileLock
ZwMapViewOfSection
ExInitializeResourceLite
RtlFindLongestRunClear
FsRtlIsHpfsDbcsLegal
RtlSetAllBits
PsGetCurrentProcessId
CcPreparePinWrite
RtlUnicodeToMultiByteN
KeCancelTimer
IoInitializeTimer
ZwCreateFile
IoRegisterDeviceInterface
ZwAllocateVirtualMemory
MmHighestUserAddress
FsRtlNotifyUninitializeSync
ExVerifySuite
RtlUpcaseUnicodeChar
IoBuildSynchronousFsdRequest
ObReferenceObjectByHandle
RtlMapGenericMask
SeCaptureSubjectContext
ZwQueryVolumeInformationFile
RtlGetNextRange
CcFastCopyWrite
IoQueueWorkItem
RtlCreateRegistryKey
ExLocalTimeToSystemTime
IoCreateDevice
RtlInitializeSid
ExFreePool
KeSetKernelStackSwapEnable
RtlCompareMemory
FsRtlCheckLockForReadAccess
IoGetDeviceObjectPointer
IoWMIRegistrationControl
IoCheckShareAccess
PsGetCurrentThreadId
ExAcquireFastMutexUnsafe
IoGetDeviceInterfaceAlias
KeInitializeDpc
ProbeForRead
MmForceSectionClosed
KeInitializeApc
KeReadStateEvent
ExDeleteResourceLite
IoFreeMdl
KeInsertHeadQueue
RtlOemStringToUnicodeString
IoWriteErrorLogEntry
KeSynchronizeExecution
ZwQuerySymbolicLinkObject
ExReleaseFastMutexUnsafe
KeInitializeEvent
SeTokenIsRestricted
RtlAddAccessAllowedAceEx
FsRtlSplitLargeMcb
RtlCopyLuid
ZwQueryKey
RtlGUIDFromString
RtlFindClearRuns
PoSetSystemState
PoCallDriver
RtlRandom
RtlCopyUnicodeString
IoCreateFile
RtlLengthRequiredSid
RtlUpcaseUnicodeToOemN
PsLookupProcessByProcessId
ExNotifyCallback
RtlUnicodeToOemN
IoSetSystemPartition
KeQueryActiveProcessors
KeRemoveEntryDeviceQueue
IoRaiseHardError
RtlUpperString
KdDisableDebugger
KeReadStateMutex
ZwFreeVirtualMemory
RtlFindClearBitsAndSet
ProbeForWrite
ZwCreateDirectoryObject
IoDisconnectInterrupt
MmUnlockPagableImageSection
ExSetResourceOwnerPointer
KeInsertQueue
CcIsThereDirtyData
KeInitializeQueue
ExReleaseResourceLite
Sections
.text Size: 35KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 1024B - Virtual size: 577B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ