F:\lmeeQzjssSsLKu\tPelIAtbpItmxf\gieKHfXyHU\JifrdlHGsIt\tFwDonARbuftoB.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3c7288344306a49d323d96dae64ec67a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c7288344306a49d323d96dae64ec67a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3c7288344306a49d323d96dae64ec67a_JaffaCakes118
-
Size
56KB
-
MD5
3c7288344306a49d323d96dae64ec67a
-
SHA1
f38a86d7a2b721a0e4f33a954f036b05d0c7dff2
-
SHA256
40f7c2de7ea8e094c868dbf72935838d745bf1624d161c950fb77ce4207ff4e1
-
SHA512
1ee806dda7a0521970b0b340f70c17dce600ba120036e14b7a392c9368391ea36a48c7f942c0cc814adf540bff1c9f92ee33855fe5a9023bbee12f11e187d0a2
-
SSDEEP
1536:EyjOxpivxL3jNL4oN4/bZiJ2Z6+DfaRiSuN5oy65K:EyjF3jSoiY/+Dfwd+5o7K
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3c7288344306a49d323d96dae64ec67a_JaffaCakes118
Files
-
3c7288344306a49d323d96dae64ec67a_JaffaCakes118.dll windows:5 windows x86 arch:x86
514f9a60365cc56ff5cdf599e201762c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlUpperChar
IoStartTimer
KeWaitForMultipleObjects
RtlDowncaseUnicodeString
IoSetShareAccess
RtlInsertUnicodePrefix
RtlInitUnicodeString
ZwAllocateVirtualMemory
PoCallDriver
ExAcquireFastMutexUnsafe
RtlInitString
RtlEqualString
ExReleaseResourceLite
RtlCopyUnicodeString
RtlEqualUnicodeString
IoUpdateShareAccess
KeUnstackDetachProcess
MmUnsecureVirtualMemory
RtlUnicodeToOemN
ExGetSharedWaiterCount
FsRtlFastUnlockSingle
RtlCreateUnicodeString
RtlCompareString
RtlIntegerToUnicodeString
FsRtlCheckOplock
IoFreeMdl
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 880B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ