X:\hnVNxrpWSfx\frLnPmFDCjkZlBxrJtce\ybBnZqisbqncgrwpkhi\yskxngygPdnUxqvXq\tcEvpivuOEnmzA\zkqsVITyiraknqzMuuD\iwjppSvIudmvwoxjlrB\UNGmfgresThg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
30c158153cd02a28c6083934d25a970e_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
30c158153cd02a28c6083934d25a970e_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
30c158153cd02a28c6083934d25a970e_JaffaCakes118
-
Size
180KB
-
MD5
30c158153cd02a28c6083934d25a970e
-
SHA1
6ea3578605a4a9df371bce3c5887ea6c3c00f6a3
-
SHA256
467c0f5849094b890ef6221942a9e0416eb201be72b3e5f56d4974d09d79ec77
-
SHA512
729e5872d8dae61dded5bd9f03af6249467246daaa954fce128c2bcdafb42b1f5b374d724a3fc119074ad5bf85f73af3766ec64b87276bde6ef23070e6001071
-
SSDEEP
3072:hhGEovjc/DSrVW19WekpQfy/wY+N6nwBMUfgnZEeZPn0thbeeFPoYGBOdX:nGEgALOVsWtmjYxeqZEEPSBjLc2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 30c158153cd02a28c6083934d25a970e_JaffaCakes118
Files
-
30c158153cd02a28c6083934d25a970e_JaffaCakes118.dll windows:5 windows x86 arch:x86
09e14156213e58fd6dfd64a990dce762
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlIntegerToUnicodeString
KeEnterCriticalRegion
RtlCharToInteger
ExSetResourceOwnerPointer
ZwDeleteKey
KeInsertDeviceQueue
RtlCompareString
KeCancelTimer
IoGetDriverObjectExtension
RtlCompareUnicodeString
MmCanFileBeTruncated
IoRemoveShareAccess
ExAllocatePoolWithQuotaTag
RtlInitString
RtlFindClearBitsAndSet
RtlInitUnicodeString
KeInitializeTimerEx
ObReferenceObjectByHandle
IoAcquireCancelSpinLock
strncpy
RtlEqualUnicodeString
IoGetCurrentProcess
IoFreeIrp
RtlUpperChar
RtlEqualString
Sections
.text Size: 23KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 780B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ