L:\vafjFjbvdon\wTaHtZdg\ovxebxX\LevApty\clxutmmcshlCJ.pdb
Static task
static1
Behavioral task
behavioral1
Sample
391fe122fe664786b4c5fb63099c8746_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
391fe122fe664786b4c5fb63099c8746_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
391fe122fe664786b4c5fb63099c8746_JaffaCakes118
-
Size
447KB
-
MD5
391fe122fe664786b4c5fb63099c8746
-
SHA1
197564314714f27139d33252730fe85af08c75a1
-
SHA256
a74c8a07ee9eb6e3eaf3cdb70eaee335f7cba0335dd6e02dd0315c1a76728d05
-
SHA512
16bb6be227b5cd92ea518f96462d4cd1c059b5321d2aa7f7101019068c0f5f76056c2b5550d3416c63f438cc464b37dba501a9ca78bb994d15e805ca95e980e3
-
SSDEEP
12288:/pga+Sq2qCeM9ciRJJSF3uIMvCkrZrquXK:9+v7YruF3uIoCk1t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 391fe122fe664786b4c5fb63099c8746_JaffaCakes118
Files
-
391fe122fe664786b4c5fb63099c8746_JaffaCakes118.dll windows:5 windows x86 arch:x86
b59a236cab91f4b489053d109ed2e7c5
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlGetNextRange
RtlFindClearBitsAndSet
IoRemoveShareAccess
RtlCompareUnicodeString
ExDeleteResourceLite
IoCreateNotificationEvent
RtlLengthRequiredSid
IoCreateFile
MmBuildMdlForNonPagedPool
SeCreateClientSecurity
MmForceSectionClosed
FsRtlLookupLastLargeMcbEntry
KeQuerySystemTime
ExGetPreviousMode
KeInitializeDpc
FsRtlDeregisterUncProvider
IoReleaseCancelSpinLock
KeInitializeDeviceQueue
IoCheckEaBufferValidity
ExReinitializeResourceLite
MmSecureVirtualMemory
MmUnmapLockedPages
IoSetHardErrorOrVerifyDevice
RtlCompareString
MmLockPagableDataSection
RtlClearAllBits
FsRtlSplitLargeMcb
KeRundownQueue
SeAccessCheck
MmFreeNonCachedMemory
RtlCreateUnicodeString
KeInitializeSemaphore
FsRtlIsHpfsDbcsLegal
PsGetCurrentProcess
IoGetBootDiskInformation
PsGetVersion
KeReadStateEvent
CcRemapBcb
IoInvalidateDeviceRelations
IoStartPacket
IoAllocateMdl
ExGetSharedWaiterCount
RtlFillMemoryUlong
ZwFsControlFile
ExSystemTimeToLocalTime
RtlWriteRegistryValue
IoOpenDeviceRegistryKey
SeQueryAuthenticationIdToken
PsLookupProcessByProcessId
KeInitializeTimerEx
KeStackAttachProcess
PoSetPowerState
KeResetEvent
MmSizeOfMdl
ExSetTimerResolution
KeEnterCriticalRegion
ExRegisterCallback
RtlValidSecurityDescriptor
KeRemoveDeviceQueue
RtlEqualUnicodeString
IoFreeIrp
MmUnlockPagableImageSection
PsLookupThreadByThreadId
PoRegisterSystemState
IoRequestDeviceEject
IoIsWdmVersionAvailable
IoGetAttachedDeviceReference
FsRtlIsNameInExpression
RtlAnsiStringToUnicodeString
RtlClearBits
KeRemoveQueueDpc
SeTokenIsRestricted
KeSynchronizeExecution
MmHighestUserAddress
MmAllocateNonCachedMemory
RtlInitAnsiString
IoAttachDeviceToDeviceStack
CcZeroData
RtlFindLastBackwardRunClear
RtlLengthSecurityDescriptor
RtlTimeFieldsToTime
PsIsThreadTerminating
CcIsThereDirtyData
IoDisconnectInterrupt
RtlSetBits
KeDeregisterBugCheckCallback
RtlDeleteRegistryValue
RtlAppendUnicodeToString
RtlCheckRegistryKey
RtlFindClearBits
IoDeleteDevice
RtlNtStatusToDosError
FsRtlCheckOplock
RtlxAnsiStringToUnicodeSize
IoDeleteController
KeInsertQueue
IoFreeMdl
PsTerminateSystemThread
IoWMIRegistrationControl
ZwAllocateVirtualMemory
IoStartTimer
MmMapLockedPagesSpecifyCache
ExUnregisterCallback
RtlRemoveUnicodePrefix
ExNotifyCallback
IoCheckQuotaBufferValidity
RtlCompareMemory
ZwOpenProcess
DbgBreakPointWithStatus
KeReadStateSemaphore
IoSetDeviceInterfaceState
RtlQueryRegistryValues
CcPreparePinWrite
RtlFindSetBits
KeQueryInterruptTime
FsRtlNotifyInitializeSync
KeDelayExecutionThread
ExLocalTimeToSystemTime
ExFreePool
ExRaiseDatatypeMisalignment
IoAllocateWorkItem
RtlInsertUnicodePrefix
MmFreeContiguousMemory
MmIsDriverVerifying
KeLeaveCriticalRegion
RtlCopySid
ExAcquireFastMutexUnsafe
RtlTimeToTimeFields
SeValidSecurityDescriptor
RtlMapGenericMask
IoDeviceObjectType
FsRtlNotifyUninitializeSync
ZwQueryKey
RtlPrefixUnicodeString
ExDeleteNPagedLookasideList
KeClearEvent
MmGetSystemRoutineAddress
RtlFreeAnsiString
MmLockPagableSectionByHandle
ZwCreateDirectoryObject
RtlEnumerateGenericTable
KeSetTimer
KeInitializeMutex
FsRtlIsDbcsInExpression
FsRtlFastUnlockSingle
RtlRandom
ExAllocatePoolWithTag
RtlAreBitsClear
MmQuerySystemSize
KeSetImportanceDpc
KeReleaseSemaphore
KeInitializeEvent
KdEnableDebugger
KeInsertDeviceQueue
IoUpdateShareAccess
CcFastCopyRead
ProbeForWrite
ZwCreateFile
IoStartNextPacket
IoGetDeviceToVerify
RtlCopyUnicodeString
KeRemoveByKeyDeviceQueue
RtlAppendStringToString
MmAllocateContiguousMemory
RtlFindLeastSignificantBit
FsRtlGetNextFileLock
IoGetStackLimits
IoDetachDevice
IoAllocateController
FsRtlIsFatDbcsLegal
RtlCharToInteger
KeRemoveQueue
CcSetBcbOwnerPointer
IoGetAttachedDevice
RtlValidSid
ZwMakeTemporaryObject
IoCreateSynchronizationEvent
KeQueryActiveProcessors
IoInvalidateDeviceState
SeDeassignSecurity
RtlInitUnicodeString
IoRaiseHardError
ExRaiseStatus
RtlCopyLuid
RtlEqualSid
SeAssignSecurity
ZwOpenSection
IoInitializeTimer
KdDisableDebugger
KeSetBasePriorityThread
PoStartNextPowerIrp
ExVerifySuite
ZwQueryInformationFile
KeReleaseMutex
PoRequestPowerIrp
RtlUpperChar
RtlAnsiCharToUnicodeChar
KeInsertByKeyDeviceQueue
KeSetTimerEx
SeQueryInformationToken
CcCopyRead
CcFastMdlReadWait
KeRegisterBugCheckCallback
IoIsSystemThread
ObReleaseObjectSecurity
IoCancelIrp
CcDeferWrite
KeUnstackDetachProcess
IoSetSystemPartition
ExUuidCreate
MmGetPhysicalAddress
IoQueueWorkItem
FsRtlAllocateFileLock
IoGetRelatedDeviceObject
RtlDeleteNoSplay
FsRtlIsTotalDeviceFailure
RtlFindClearRuns
RtlGetVersion
ZwCreateSection
RtlUnicodeStringToAnsiString
FsRtlFastCheckLockForRead
IoAcquireCancelSpinLock
ZwDeleteValueKey
IoGetRequestorProcessId
IoDeleteSymbolicLink
ZwReadFile
KeInitializeSpinLock
CcCopyWrite
KeReadStateTimer
ExReleaseFastMutexUnsafe
IoBuildSynchronousFsdRequest
RtlOemStringToUnicodeString
KeFlushQueuedDpcs
IoAllocateErrorLogEntry
ZwFreeVirtualMemory
RtlMultiByteToUnicodeN
SeImpersonateClientEx
IoFreeController
ProbeForRead
ObReferenceObjectByPointer
IoRegisterDeviceInterface
IoWriteErrorLogEntry
KeRemoveEntryDeviceQueue
IoGetDeviceInterfaceAlias
IoBuildPartialMdl
ObReferenceObjectByHandle
MmUnmapIoSpace
RtlInitializeSid
RtlUpcaseUnicodeChar
IoCreateStreamFileObjectLite
ZwCreateKey
RtlEqualString
IoSetShareAccess
RtlFindMostSignificantBit
RtlSecondsSince1980ToTime
RtlCreateSecurityDescriptor
Sections
.text Size: 37KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 362B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 688B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ