E:\kwqlDxjYR\shrftHqHqmmsIj\ctsjbjSxYyWh\rpqqxnzjdwpcm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
378f06017b4b399034415cee1f90a2a2_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
378f06017b4b399034415cee1f90a2a2_JaffaCakes118.dll
Resource
win10v2004-20240704-en
General
-
Target
378f06017b4b399034415cee1f90a2a2_JaffaCakes118
-
Size
73KB
-
MD5
378f06017b4b399034415cee1f90a2a2
-
SHA1
6813d261bbf2481d7ef21f595f3e2f5b0240d0ce
-
SHA256
5884e69f9519439dc36c175221f2f79b0179103159ec0b570c9731630d8cfe32
-
SHA512
95a2d01b1bbf3ddb7c6dd73421e1738c050b3c378ab145652f7136477e7ada1a2ee95f0228787f9ca8863dd9c2c7b887fbd7f7f85e229ab299c4d7362aa712a0
-
SSDEEP
768:9a1e1G5FPoiWHgW0BCfFih1N+tB7BL291s94SGuB2pQQR+amzE13GAgjvQ7HiHt/:9t0FyAWwCf4NA7R2PChxMprRJGZ7vN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 378f06017b4b399034415cee1f90a2a2_JaffaCakes118
Files
-
378f06017b4b399034415cee1f90a2a2_JaffaCakes118.dll windows:5 windows x86 arch:x86
6d10222eafb8bbbf76a504c82293b714
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeRestoreFloatingPointState
RtlTimeToTimeFields
ZwReadFile
IoSetDeviceInterfaceState
ObfReferenceObject
KeInitializeMutex
IoGetDiskDeviceObject
KeGetCurrentThread
ZwOpenProcess
CcFastCopyRead
RtlFreeAnsiString
RtlUnicodeToOemN
IoQueryFileDosDeviceName
KeInitializeDeviceQueue
ZwFsControlFile
MmGetSystemRoutineAddress
RtlTimeToSecondsSince1980
IoEnumerateDeviceObjectList
FsRtlIsFatDbcsLegal
SeValidSecurityDescriptor
SeSetSecurityDescriptorInfo
RtlInitializeGenericTable
MmCanFileBeTruncated
MmQuerySystemSize
IoCreateSynchronizationEvent
FsRtlMdlWriteCompleteDev
PsGetProcessId
IoWritePartitionTableEx
IoGetCurrentProcess
KeInitializeSemaphore
MmBuildMdlForNonPagedPool
CcSetDirtyPinnedData
RtlEqualUnicodeString
ZwOpenSymbolicLinkObject
KeInsertHeadQueue
ObfDereferenceObject
IoFreeMdl
IoDeleteDevice
MmUnlockPagableImageSection
IoFreeErrorLogEntry
CcIsThereDirtyData
KeDelayExecutionThread
CcZeroData
IoWMIWriteEvent
IoVerifyVolume
IoInitializeTimer
MmUnmapLockedPages
IoAllocateController
PsGetProcessExitTime
IoGetBootDiskInformation
ZwFreeVirtualMemory
IoAllocateWorkItem
RtlHashUnicodeString
RtlCharToInteger
RtlFindClearRuns
MmUnmapReservedMapping
ZwOpenFile
SeLockSubjectContext
PoRegisterSystemState
KeQuerySystemTime
IoRaiseHardError
ProbeForWrite
IoBuildSynchronousFsdRequest
RtlAppendUnicodeToString
IoGetRequestorProcessId
ObQueryNameString
ObOpenObjectByPointer
KeRemoveDeviceQueue
IoDeleteSymbolicLink
IoQueueWorkItem
RtlValidSecurityDescriptor
IoIsSystemThread
RtlInitUnicodeString
KeSetEvent
CcFastCopyWrite
ExFreePool
KeBugCheck
PsChargeProcessPoolQuota
IoReleaseVpbSpinLock
ObInsertObject
PsReturnPoolQuota
RtlNtStatusToDosError
RtlxAnsiStringToUnicodeSize
ZwOpenSection
IoSetPartitionInformation
RtlAnsiCharToUnicodeChar
RtlLengthSecurityDescriptor
ExDeleteNPagedLookasideList
IoQueryDeviceDescription
RtlUpcaseUnicodeToOemN
ZwEnumerateValueKey
MmForceSectionClosed
RtlInsertUnicodePrefix
ZwCreateFile
ZwClose
ZwQueryKey
KeBugCheckEx
ZwCreateKey
ExSetTimerResolution
RtlOemToUnicodeN
KeRemoveQueue
MmProbeAndLockPages
ExVerifySuite
SePrivilegeCheck
ExRegisterCallback
PsRevertToSelf
ExAcquireResourceSharedLite
ExInitializeResourceLite
FsRtlCheckLockForReadAccess
RtlFindLongestRunClear
MmSecureVirtualMemory
RtlClearAllBits
IoIsWdmVersionAvailable
CcPreparePinWrite
ZwUnloadDriver
CcMdlReadComplete
MmHighestUserAddress
IoDisconnectInterrupt
IoStartNextPacket
KeSetKernelStackSwapEnable
RtlNumberOfClearBits
KeInitializeTimer
RtlFreeOemString
IoReadPartitionTableEx
PsGetCurrentThread
ZwSetSecurityObject
RtlGetVersion
KeSetBasePriorityThread
RtlAppendStringToString
MmAllocateContiguousMemory
PoRequestPowerIrp
RtlUnicodeStringToInteger
CcFlushCache
ZwDeviceIoControlFile
RtlOemStringToUnicodeString
IoStopTimer
ZwQuerySymbolicLinkObject
PsImpersonateClient
RtlxUnicodeStringToAnsiSize
KeEnterCriticalRegion
ZwQueryInformationFile
MmFreeNonCachedMemory
ExRaiseDatatypeMisalignment
ZwEnumerateKey
IoCancelIrp
IoAllocateMdl
PoSetSystemState
CcCanIWrite
ExDeletePagedLookasideList
RtlSetDaclSecurityDescriptor
KeSetSystemAffinityThread
CcUnpinData
MmProbeAndLockProcessPages
ExUuidCreate
IoAllocateIrp
IoWMIRegistrationControl
CcMdlRead
IoAllocateAdapterChannel
RtlCreateRegistryKey
SeReleaseSubjectContext
RtlFindClearBitsAndSet
ZwQueryVolumeInformationFile
KeQueryActiveProcessors
FsRtlLookupLastLargeMcbEntry
IoGetAttachedDevice
ExFreePoolWithTag
PoUnregisterSystemState
KeRundownQueue
MmIsVerifierEnabled
KeRemoveQueueDpc
IoGetDeviceAttachmentBaseRef
MmPageEntireDriver
IoReportResourceForDetection
PsGetVersion
FsRtlFreeFileLock
ExGetPreviousMode
RtlGetCallersAddress
IoSetDeviceToVerify
RtlDeleteRegistryValue
KdEnableDebugger
MmAddVerifierThunks
ZwPowerInformation
DbgBreakPoint
IoAcquireVpbSpinLock
IoUnregisterFileSystem
MmGetPhysicalAddress
IoReleaseRemoveLockEx
ZwQueryObject
ZwFlushKey
RtlGenerate8dot3Name
RtlCheckRegistryKey
IoGetDmaAdapter
IoWriteErrorLogEntry
RtlCopyUnicodeString
RtlFindLastBackwardRunClear
ExReleaseResourceLite
SeFreePrivileges
IoRegisterFileSystem
PsDereferencePrimaryToken
IoGetDeviceObjectPointer
RtlFindMostSignificantBit
ZwLoadDriver
RtlDeleteElementGenericTable
RtlValidSid
IoStartTimer
CcSetReadAheadGranularity
KeWaitForSingleObject
RtlEqualString
PsGetCurrentProcess
KeQueryTimeIncrement
RtlVerifyVersionInfo
KeReadStateSemaphore
CcRemapBcb
ObMakeTemporaryObject
RtlUnicodeStringToOemString
CcGetFileObjectFromBcb
KeSetTimerEx
KeLeaveCriticalRegion
MmAdvanceMdl
MmMapLockedPages
ZwSetVolumeInformationFile
RtlFindSetBits
ExRaiseAccessViolation
RtlAreBitsClear
SeDeassignSecurity
IoGetDeviceToVerify
RtlUpperString
RtlUnicodeToMultiByteN
IoReadDiskSignature
RtlInitializeSid
RtlSecondsSince1970ToTime
SeQueryAuthenticationIdToken
IoGetRequestorProcess
KeRemoveEntryDeviceQueue
CcSetBcbOwnerPointer
CcMapData
RtlInitAnsiString
IoCreateNotificationEvent
PsGetThreadProcessId
RtlCreateAcl
FsRtlSplitLargeMcb
KeUnstackDetachProcess
CcMdlWriteAbort
IoInitializeRemoveLockEx
KeInsertDeviceQueue
SeTokenIsRestricted
RtlFindUnicodePrefix
ObCreateObject
RtlCopyLuid
MmAllocateMappingAddress
RtlFreeUnicodeString
DbgBreakPointWithStatus
KefAcquireSpinLockAtDpcLevel
RtlFillMemoryUlong
KeInitializeDpc
FsRtlIsDbcsInExpression
IoRegisterDeviceInterface
Exports
Exports
?CrtProjectOriginal@@YGKEDKPAJ]A
?ModifyOptionOriginal@@YGIDG]A
Sections
.text Size: 29KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.dbg Size: 512B - Virtual size: 83B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 716B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ