H:\rxQQouqwiD\ddzyojaLIdeGwi\QMivtdxAtmiy\ytYlsGvn\pttjWxowXg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3a46c2cb46376c58736635dafbcd19a9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3a46c2cb46376c58736635dafbcd19a9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3a46c2cb46376c58736635dafbcd19a9_JaffaCakes118
-
Size
159KB
-
MD5
3a46c2cb46376c58736635dafbcd19a9
-
SHA1
bff5a2915620f1235b6371370221d66f106f838a
-
SHA256
a2e69dc1b995fb892fa3f39cbadbd238a73ec4cc5502e2ad4e5a36767e6acfb0
-
SHA512
86fc03b565d5198e43626a79885d455909b430abc4ab4d777f8cf8508b03d6077df6025dc60c9a1458e7819e9f42b53983c50ebf5552fb0cbc93e6ea9298e184
-
SSDEEP
3072:6+XJ7Hm72n0C2cJaJFs0r9gkJKqDm+TAnBRjvt:rm700C2ckJ4f+iBRjv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3a46c2cb46376c58736635dafbcd19a9_JaffaCakes118
Files
-
3a46c2cb46376c58736635dafbcd19a9_JaffaCakes118.dll windows:5 windows x86 arch:x86
421e7507599a9a2796369132972c5917
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoCreateDevice
ObCreateObject
RtlFreeAnsiString
RtlAppendUnicodeToString
ExUuidCreate
IoUpdateShareAccess
KeReadStateSemaphore
KeRegisterBugCheckCallback
SeDeassignSecurity
RtlClearBits
ZwEnumerateValueKey
IoConnectInterrupt
ZwQueryKey
IoRegisterDeviceInterface
RtlInitializeUnicodePrefix
KeInitializeDeviceQueue
ZwOpenSection
IoFreeMdl
MmBuildMdlForNonPagedPool
IoFreeWorkItem
ExReleaseResourceLite
FsRtlAllocateFileLock
ZwOpenKey
ZwFsControlFile
KeSetTimerEx
RtlxUnicodeStringToAnsiSize
PsDereferencePrimaryToken
RtlInsertUnicodePrefix
IoCreateNotificationEvent
ZwDeleteValueKey
FsRtlMdlWriteCompleteDev
RtlUpperString
RtlHashUnicodeString
KeInsertDeviceQueue
KeBugCheck
IoFreeController
RtlGetNextRange
IoInitializeIrp
KeSetBasePriorityThread
RtlCopySid
RtlUnicodeToOemN
KeWaitForSingleObject
KeUnstackDetachProcess
CcRemapBcb
IoCreateStreamFileObjectLite
ExIsProcessorFeaturePresent
IoDetachDevice
ExReleaseFastMutexUnsafe
IoGetDeviceObjectPointer
IoGetDeviceToVerify
RtlTimeFieldsToTime
ZwCreateFile
RtlAreBitsClear
IoWriteErrorLogEntry
RtlValidSid
RtlUnicodeToMultiByteN
MmFreeNonCachedMemory
KeInitializeEvent
MmMapIoSpace
KeSaveFloatingPointState
IoGetDeviceProperty
RtlInitAnsiString
FsRtlCheckLockForWriteAccess
IoGetAttachedDeviceReference
KeCancelTimer
ExUnregisterCallback
IoInvalidateDeviceRelations
SeCreateClientSecurity
RtlFindLeastSignificantBit
RtlSubAuthoritySid
RtlAddAccessAllowedAceEx
RtlUpcaseUnicodeToOemN
RtlCopyUnicodeString
IoGetStackLimits
ExDeleteResourceLite
KeFlushQueuedDpcs
MmSizeOfMdl
ProbeForRead
KeSetImportanceDpc
PsGetCurrentProcessId
ExDeleteNPagedLookasideList
KeQuerySystemTime
IoCreateSymbolicLink
KeGetCurrentThread
FsRtlSplitLargeMcb
ZwQueryObject
KeReadStateMutex
KeRemoveEntryDeviceQueue
SeValidSecurityDescriptor
FsRtlCheckLockForReadAccess
RtlAnsiCharToUnicodeChar
RtlUpcaseUnicodeChar
ExGetPreviousMode
FsRtlCheckOplock
RtlInitializeGenericTable
IoSetDeviceInterfaceState
MmLockPagableDataSection
IoCheckShareAccess
KeInitializeQueue
RtlDowncaseUnicodeString
MmUnlockPagableImageSection
PsGetVersion
IoCreateFile
RtlFindUnicodePrefix
FsRtlNotifyUninitializeSync
KeReleaseSemaphore
IoGetCurrentProcess
MmIsAddressValid
RtlMultiByteToUnicodeN
RtlGetVersion
IoGetRequestorProcessId
SeOpenObjectAuditAlarm
MmForceSectionClosed
IoAllocateWorkItem
ZwQueryInformationFile
DbgBreakPointWithStatus
SeSinglePrivilegeCheck
ZwCreateKey
SeAccessCheck
PsGetCurrentThread
RtlFindClearRuns
SeTokenIsAdmin
RtlCharToInteger
ZwOpenSymbolicLinkObject
ExLocalTimeToSystemTime
RtlRemoveUnicodePrefix
RtlFindMostSignificantBit
IoSetThreadHardErrorMode
RtlCopyLuid
IoSetSystemPartition
IoAcquireCancelSpinLock
ExAcquireFastMutexUnsafe
RtlFindClearBitsAndSet
ExRaiseStatus
KeDelayExecutionThread
MmFreeContiguousMemory
ObQueryNameString
KeInsertByKeyDeviceQueue
MmLockPagableSectionByHandle
RtlFindClearBits
RtlFindNextForwardRunClear
PsSetLoadImageNotifyRoutine
KeBugCheckEx
RtlSetAllBits
SeCaptureSubjectContext
ZwCreateSection
IoIsSystemThread
RtlInitializeBitMap
IoGetDeviceInterfaceAlias
RtlWriteRegistryValue
ZwQuerySymbolicLinkObject
IoAllocateController
RtlCreateRegistryKey
IoSetShareAccess
CcPreparePinWrite
RtlSecondsSince1980ToTime
CcIsThereDirtyData
MmResetDriverPaging
IoStartNextPacket
KeReadStateEvent
IoRaiseHardError
KeStackAttachProcess
RtlRandom
PoSetPowerState
RtlEqualSid
IoAllocateIrp
ObReferenceObjectByPointer
ExDeletePagedLookasideList
KdDisableDebugger
RtlSecondsSince1970ToTime
RtlDeleteNoSplay
KePulseEvent
RtlTimeToTimeFields
IoGetAttachedDevice
PoUnregisterSystemState
ObReleaseObjectSecurity
CcFastMdlReadWait
KeReadStateTimer
ExCreateCallback
PsGetCurrentProcess
PsTerminateSystemThread
ZwOpenProcess
ExFreePoolWithTag
RtlCompareMemory
MmSecureVirtualMemory
RtlEnumerateGenericTable
ExSetTimerResolution
RtlSetBits
ZwMakeTemporaryObject
RtlFindSetBits
ExVerifySuite
ExAcquireResourceSharedLite
ExSystemTimeToLocalTime
MmQuerySystemSize
IoDisconnectInterrupt
IoWMIRegistrationControl
IoFreeIrp
CcUnpinDataForThread
RtlAnsiStringToUnicodeString
RtlFillMemoryUlong
KeSetPriorityThread
FsRtlFastCheckLockForRead
ZwAllocateVirtualMemory
RtlCreateUnicodeString
MmHighestUserAddress
RtlUpcaseUnicodeString
ProbeForWrite
KeInitializeTimer
IoAttachDeviceToDeviceStack
CcDeferWrite
KeQueryTimeIncrement
PsGetCurrentThreadId
FsRtlIsDbcsInExpression
MmCanFileBeTruncated
RtlCheckRegistryKey
IoStartTimer
KeInitializeTimerEx
ExAllocatePoolWithQuotaTag
IoIsWdmVersionAvailable
RtlFindLongestRunClear
KeClearEvent
ZwDeleteKey
PoSetSystemState
RtlInitUnicodeString
IoReportResourceForDetection
KeRemoveByKeyDeviceQueue
ExInitializeResourceLite
RtlCreateSecurityDescriptor
RtlUnicodeStringToAnsiString
MmGetSystemRoutineAddress
ZwQueryVolumeInformationFile
IoGetDeviceInterfaces
MmFreePagesFromMdl
KeSetKernelStackSwapEnable
RtlEqualString
CcZeroData
ExRaiseDatatypeMisalignment
FsRtlIsNameInExpression
IoDeleteSymbolicLink
RtlEqualUnicodeString
ZwReadFile
CcFastCopyWrite
IoInitializeTimer
RtlTimeToSecondsSince1970
MmAllocateNonCachedMemory
KeSetTimer
SeQueryInformationToken
FsRtlFastUnlockSingle
RtlQueryRegistryValues
IoCancelIrp
IoBuildPartialMdl
KeInsertQueue
IoBuildSynchronousFsdRequest
KeSetEvent
RtlLengthRequiredSid
IoReportDetectedDevice
KeRemoveQueueDpc
SeTokenIsRestricted
ZwFlushKey
RtlNtStatusToDosError
MmGetPhysicalAddress
Sections
.text Size: 34KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ