V:\genPzymrU\tewkAggg\ShjztptV.pdb
Static task
static1
Behavioral task
behavioral1
Sample
37be99e2b197a3171bd773ad2700aca0_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
37be99e2b197a3171bd773ad2700aca0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
37be99e2b197a3171bd773ad2700aca0_JaffaCakes118
-
Size
39KB
-
MD5
37be99e2b197a3171bd773ad2700aca0
-
SHA1
edb0d4d915f6b0366d7eb429e995b4b1df8ffd57
-
SHA256
56998cd02bb2b94880be36bd24f9c4c93a0ce7082313d9902da71c2ac92dd82b
-
SHA512
ad4ab9baac70627057f68ff0518dcc1bb49bf38d6230c94035ffc839a76ec9a3d65aae381609889d0bfc56ef3a2a3a7d6a9f88ec935192454650b504f8ec4680
-
SSDEEP
768:he3NBanuU3dfLcjqVAYrDaK6/SA3GKIDVdYmrnfQsUU5F:h0NBanuUNT7eK6/P6nIsf3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 37be99e2b197a3171bd773ad2700aca0_JaffaCakes118
Files
-
37be99e2b197a3171bd773ad2700aca0_JaffaCakes118.dll windows:5 windows x86 arch:x86
99362f27cedb18190823d254d440804c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeRemoveQueueDpc
ExRaiseDatatypeMisalignment
KeReadStateTimer
RtlLengthSecurityDescriptor
KeClearEvent
IoUpdateShareAccess
RtlCharToInteger
RtlSubAuthoritySid
IoGetBootDiskInformation
RtlxAnsiStringToUnicodeSize
ExAcquireFastMutexUnsafe
RtlNtStatusToDosError
SeValidSecurityDescriptor
KeRemoveByKeyDeviceQueue
ExSystemTimeToLocalTime
RtlRemoveUnicodePrefix
IoAllocateController
ZwCreateKey
KeEnterCriticalRegion
RtlGetVersion
RtlFillMemoryUlong
KeInitializeTimer
IoStartNextPacket
RtlGUIDFromString
IoRaiseHardError
IoWMIRegistrationControl
RtlCopyUnicodeString
MmMapLockedPagesSpecifyCache
MmPageEntireDriver
IoCreateNotificationEvent
IoGetDmaAdapter
ZwOpenFile
KeQueryInterruptTime
RtlMultiByteToUnicodeN
KeInsertDeviceQueue
IoAttachDeviceToDeviceStack
ZwMakeTemporaryObject
KeStackAttachProcess
RtlxUnicodeStringToAnsiSize
IoStopTimer
DbgBreakPointWithStatus
IoAllocateIrp
SeQueryInformationToken
ZwEnumerateKey
PsGetCurrentProcessId
RtlFindNextForwardRunClear
RtlCopyLuid
ZwQueryInformationFile
IoInitializeTimer
RtlSecondsSince1980ToTime
RtlInitAnsiString
FsRtlCheckOplock
IoGetDeviceProperty
IoBuildSynchronousFsdRequest
KeSetTimer
RtlAppendUnicodeToString
KeQueryActiveProcessors
FsRtlIsFatDbcsLegal
SeDeleteObjectAuditAlarm
RtlUnicodeStringToAnsiString
IoInvalidateDeviceRelations
KeSetEvent
ExVerifySuite
IoCreateSynchronizationEvent
RtlCheckRegistryKey
PoCallDriver
IoWriteErrorLogEntry
IoQueueWorkItem
RtlGetNextRange
KdEnableDebugger
IoCreateDevice
RtlMapGenericMask
RtlUpperChar
KeBugCheckEx
RtlAppendStringToString
MmResetDriverPaging
MmMapIoSpace
KeInitializeEvent
RtlEqualString
MmUnmapLockedPages
ExGetPreviousMode
KeWaitForSingleObject
SeCaptureSubjectContext
RtlValidSid
ExGetExclusiveWaiterCount
RtlDeleteRegistryValue
ExLocalTimeToSystemTime
PsGetCurrentThread
KeInitializeApc
SeAssignSecurity
RtlAreBitsSet
FsRtlLookupLastLargeMcbEntry
ZwOpenProcess
RtlSecondsSince1970ToTime
IoStartPacket
IoFreeWorkItem
PsIsThreadTerminating
ExNotifyCallback
RtlAreBitsClear
RtlCopySid
IoSetSystemPartition
KeSetPriorityThread
ExFreePoolWithTag
ExInitializeResourceLite
RtlStringFromGUID
RtlClearAllBits
ZwQueryObject
ZwDeviceIoControlFile
FsRtlIsTotalDeviceFailure
PoRequestPowerIrp
KeRemoveDeviceQueue
CcZeroData
KeRemoveQueue
CcFastCopyRead
KeInsertByKeyDeviceQueue
ZwEnumerateValueKey
RtlFindLongestRunClear
IoSetThreadHardErrorMode
MmCanFileBeTruncated
MmProbeAndLockPages
ZwCreateDirectoryObject
ZwQuerySymbolicLinkObject
KeQueryTimeIncrement
SeTokenIsRestricted
ExReleaseFastMutexUnsafe
KeReleaseMutex
IoFreeController
ZwClose
IoReuseIrp
IoGetAttachedDeviceReference
MmSetAddressRangeModified
FsRtlSplitLargeMcb
IoDeleteSymbolicLink
IoDetachDevice
RtlFindUnicodePrefix
MmUnlockPages
ExAllocatePoolWithTag
ZwOpenSymbolicLinkObject
RtlEqualSid
KeResetEvent
MmIsVerifierEnabled
CcFastMdlReadWait
RtlRandom
MmAdvanceMdl
RtlDowncaseUnicodeString
RtlSetAllBits
IoGetAttachedDevice
FsRtlIsNameInExpression
FsRtlFastCheckLockForRead
ObReferenceObjectByHandle
IoAllocateWorkItem
FsRtlCheckLockForReadAccess
RtlUpcaseUnicodeToOemN
IoInvalidateDeviceState
MmLockPagableDataSection
ZwOpenSection
RtlFindSetBits
MmFreeContiguousMemory
ZwOpenKey
IoIsWdmVersionAvailable
KeFlushQueuedDpcs
MmFreeNonCachedMemory
RtlCompareMemory
SeQueryAuthenticationIdToken
FsRtlFastUnlockSingle
KeDeregisterBugCheckCallback
MmGetSystemRoutineAddress
IoAcquireCancelSpinLock
ExDeletePagedLookasideList
ExGetSharedWaiterCount
RtlFindMostSignificantBit
MmUnmapIoSpace
KeRundownQueue
PoStartNextPowerIrp
KeRemoveEntryDeviceQueue
IoGetDeviceObjectPointer
PsLookupProcessByProcessId
PsGetCurrentThreadId
ZwDeleteValueKey
KeLeaveCriticalRegion
IoStartTimer
FsRtlDeregisterUncProvider
FsRtlGetNextFileLock
ExAcquireResourceSharedLite
KeInitializeTimerEx
FsRtlIsDbcsInExpression
Exports
Exports
?FindProviderA@@YGPAMDPAJPADPAI~U
?GetMemoryExA@@YGGMMPADPA_N~U
?IsValidPenOriginal@@YGMK_N~U
?SendComponentA@@YGFN~U
?FormatPenOriginal@@YGKPAIKPA_N~U
?ModifyExpression@@YGPAIHGGF~U
?IsObjectEx@@YGPAHIK~U
?CopySemaphoreNew@@YGGKK~U
?GlobalFullNameNew@@YGKMPAHPAK~U
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vars1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vptr1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ