D:\afSIwwleunvdQa\hxkxoCn\rcbzqjnqpr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2fc7f6cbc523e12ef6e26e8b714db39a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2fc7f6cbc523e12ef6e26e8b714db39a_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
2fc7f6cbc523e12ef6e26e8b714db39a_JaffaCakes118
-
Size
135KB
-
MD5
2fc7f6cbc523e12ef6e26e8b714db39a
-
SHA1
109fc2456712214562a0e89efed0e39b53bd1556
-
SHA256
edeafbfe04e30b2fa4948aed6afa3dfc38a72e34c522dbd0ed6dd133d787cd67
-
SHA512
f9bf3f37bc2a3ef2a709b6d1f363c54cd8571a2842482559f9f6497696492a890f1d5e7f1e8b187e592c2b686ee3a26239dbb5ec37b77695b46e6f2a88227bf6
-
SSDEEP
3072:sSOW1dVy4zpi0FvlyHvpkXGSCk+RgNJJI:Y2d5z8AyHBFSb+RwJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2fc7f6cbc523e12ef6e26e8b714db39a_JaffaCakes118
Files
-
2fc7f6cbc523e12ef6e26e8b714db39a_JaffaCakes118.dll windows:5 windows x86 arch:x86
0752547afde40ef23cd752956bb06fdb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
SeValidSecurityDescriptor
ExReleaseFastMutexUnsafe
IoRaiseHardError
IoAllocateMdl
KeRestoreFloatingPointState
RtlCompareString
ZwQueryKey
IoDeviceObjectType
RtlFindNextForwardRunClear
IoCheckShareAccess
KeFlushQueuedDpcs
KeSetImportanceDpc
KeClearEvent
PsLookupProcessByProcessId
RtlDowncaseUnicodeString
ZwCreateFile
KeUnstackDetachProcess
KeReadStateMutex
MmQuerySystemSize
KeSaveFloatingPointState
FsRtlFastUnlockSingle
MmGetSystemRoutineAddress
IoQueueWorkItem
IoRequestDeviceEject
ExSystemTimeToLocalTime
KeInsertDeviceQueue
PsLookupThreadByThreadId
ZwCreateSection
ExAcquireFastMutexUnsafe
FsRtlFreeFileLock
ZwOpenSection
IoStartNextPacket
RtlSubAuthoritySid
IoWMIRegistrationControl
IoAllocateErrorLogEntry
KeDeregisterBugCheckCallback
MmHighestUserAddress
PoCallDriver
KeSetPriorityThread
ProbeForRead
ExRaiseStatus
RtlClearAllBits
FsRtlNotifyUninitializeSync
CcSetBcbOwnerPointer
ExFreePoolWithTag
RtlVerifyVersionInfo
ZwDeviceIoControlFile
KeWaitForSingleObject
ObGetObjectSecurity
RtlTimeToSecondsSince1970
IoFreeIrp
MmProbeAndLockPages
KeSetTargetProcessorDpc
KeBugCheckEx
ZwDeleteKey
RtlCreateUnicodeString
ExIsProcessorFeaturePresent
IoStartTimer
IoAllocateWorkItem
IoUpdateShareAccess
RtlSetAllBits
KeInsertQueue
SeDeleteObjectAuditAlarm
FsRtlIsFatDbcsLegal
IoGetDeviceInterfaces
ExNotifyCallback
RtlEqualUnicodeString
RtlEnumerateGenericTable
SeTokenIsRestricted
ProbeForWrite
ZwOpenProcess
ExAcquireResourceSharedLite
MmCanFileBeTruncated
MmGetPhysicalAddress
PsSetLoadImageNotifyRoutine
IoCreateNotificationEvent
PoUnregisterSystemState
RtlUpperString
IoGetDeviceInterfaceAlias
KeQueryInterruptTime
DbgBreakPointWithStatus
FsRtlLookupLastLargeMcbEntry
FsRtlCheckLockForWriteAccess
RtlInitializeUnicodePrefix
RtlCopySid
KeSetEvent
RtlTimeFieldsToTime
IoSetHardErrorOrVerifyDevice
KeDelayExecutionThread
RtlFindLongestRunClear
IoCreateFile
FsRtlIsDbcsInExpression
PsGetVersion
SeTokenIsAdmin
IoStopTimer
IoSetSystemPartition
IoSetShareAccess
SeSinglePrivilegeCheck
KeInitializeApc
KeInitializeMutex
KeInsertQueueDpc
KeWaitForMultipleObjects
RtlUpperChar
RtlFindClearBitsAndSet
PoRequestPowerIrp
ZwEnumerateValueKey
ZwOpenFile
KeRemoveQueue
RtlCopyLuid
ZwOpenSymbolicLinkObject
IoGetStackLimits
RtlSecondsSince1980ToTime
KeReadStateTimer
ZwReadFile
RtlLengthSecurityDescriptor
FsRtlCheckOplock
ObQueryNameString
CcRemapBcb
RtlCreateSecurityDescriptor
CcFastCopyWrite
RtlRandom
RtlPrefixUnicodeString
ExUuidCreate
ExRaiseAccessViolation
IoCreateDevice
SeQueryAuthenticationIdToken
IoInitializeTimer
ExCreateCallback
RtlEqualString
RtlSetBits
KeInitializeQueue
MmFreeNonCachedMemory
RtlTimeToSecondsSince1980
PsGetCurrentThread
FsRtlGetNextFileLock
ExReleaseResourceLite
RtlCheckRegistryKey
CcPreparePinWrite
KeReadStateEvent
IoCheckEaBufferValidity
SeDeassignSecurity
RtlLengthRequiredSid
PsGetCurrentProcess
KeInitializeDeviceQueue
SeCreateClientSecurity
RtlInitializeGenericTable
ExFreePool
KeSetTimer
FsRtlCheckLockForReadAccess
IoGetDmaAdapter
PoStartNextPowerIrp
RtlFindUnicodePrefix
IoSetDeviceInterfaceState
KdDisableDebugger
RtlMultiByteToUnicodeN
KeRemoveByKeyDeviceQueue
SeQueryInformationToken
IoInvalidateDeviceRelations
RtlUnicodeStringToAnsiString
RtlAppendUnicodeToString
RtlSecondsSince1970ToTime
KeEnterCriticalRegion
KeGetCurrentThread
KeInsertByKeyDeviceQueue
IoDisconnectInterrupt
KeInitializeSpinLock
IoDeleteController
FsRtlDeregisterUncProvider
RtlDeleteRegistryValue
KeQueryActiveProcessors
ExGetExclusiveWaiterCount
IoSetThreadHardErrorMode
MmUnmapIoSpace
SeAccessCheck
KeCancelTimer
FsRtlIsNameInExpression
ZwFlushKey
KeRemoveDeviceQueue
CcUnpinDataForThread
RtlInt64ToUnicodeString
RtlUpcaseUnicodeString
CcCopyRead
RtlUpcaseUnicodeChar
MmLockPagableDataSection
SeCaptureSubjectContext
IoGetRelatedDeviceObject
RtlInitAnsiString
RtlCharToInteger
MmMapIoSpace
RtlInitializeSid
KeSetTimerEx
MmIsDriverVerifying
RtlAnsiCharToUnicodeChar
RtlCreateRegistryKey
MmUnsecureVirtualMemory
ZwQueryInformationFile
IoDeleteDevice
IoBuildPartialMdl
KeInitializeTimer
KeReleaseSemaphore
KeSetKernelStackSwapEnable
RtlFindSetBits
IoGetDeviceProperty
RtlWriteRegistryValue
RtlAreBitsSet
KeQuerySystemTime
KeStackAttachProcess
ZwQueryVolumeInformationFile
ExSetResourceOwnerPointer
RtlUnicodeToMultiByteN
MmFreeContiguousMemory
IoGetDriverObjectExtension
RtlMapGenericMask
ExLocalTimeToSystemTime
IoIsSystemThread
IoGetAttachedDevice
KePulseEvent
CcZeroData
ObCreateObject
IoAllocateIrp
IoCreateStreamFileObjectLite
RtlInitUnicodeString
IoMakeAssociatedIrp
ZwQueryObject
SeAssignSecurity
ExReinitializeResourceLite
ExRaiseDatatypeMisalignment
IoGetBootDiskInformation
IoWriteErrorLogEntry
IoCreateSynchronizationEvent
CcIsThereDirtyData
KeReleaseMutex
MmSetAddressRangeModified
ObReferenceObjectByPointer
ExUnregisterCallback
RtlCopyUnicodeString
RtlRemoveUnicodePrefix
RtlAddAccessAllowedAceEx
IoFreeWorkItem
IoAllocateController
PsGetCurrentThreadId
IoGetCurrentProcess
FsRtlSplitLargeMcb
IoDeleteSymbolicLink
RtlCopyString
RtlUpcaseUnicodeToOemN
KeRemoveQueueDpc
ExVerifySuite
KeSetBasePriorityThread
KdEnableDebugger
IoFreeController
IoDetachDevice
RtlTimeToTimeFields
IoGetAttachedDeviceReference
FsRtlMdlWriteCompleteDev
RtlFindMostSignificantBit
IoConnectInterrupt
ZwMakeTemporaryObject
RtlAreBitsClear
ZwFreeVirtualMemory
RtlDeleteNoSplay
Sections
.text Size: 35KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 1024B - Virtual size: 742B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ