E:\dkpCygxcpGEJa\esqvrtjYIyd\lPwZqyq\hoihRdpzfzNjf\klMolTWHemplmi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3e5381dfc76b320e1c3297cc14dcb2ec_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3e5381dfc76b320e1c3297cc14dcb2ec_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
3e5381dfc76b320e1c3297cc14dcb2ec_JaffaCakes118
-
Size
183KB
-
MD5
3e5381dfc76b320e1c3297cc14dcb2ec
-
SHA1
659b47c56bc3395e838d7477cce18204aede12ef
-
SHA256
6d85c1601ec70a068f563f23ec24f524137d15e3308643090c8d6673adaf3ccb
-
SHA512
7b17b710fe02bc37d11e3ba0a062099ae035277c83608805f1d1133e5ec97ee788010ab6f00f8173f5b216414d8ddda7ec59a6771ad435dc59e00cd0b30bca3b
-
SSDEEP
3072:xqUl53DdYVXJ7wDYmpW0egfexWlyK4yOTFO+HLJJedbVTQiJTfZl:xb53DrDYmp4gACyZTFOELDqTJr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3e5381dfc76b320e1c3297cc14dcb2ec_JaffaCakes118
Files
-
3e5381dfc76b320e1c3297cc14dcb2ec_JaffaCakes118.dll windows:5 windows x86 arch:x86
08697e60c0c850e3c75fc89415c10c14
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
CcPreparePinWrite
SeValidSecurityDescriptor
RtlInitAnsiString
ObReleaseObjectSecurity
KeSetKernelStackSwapEnable
ExAllocatePoolWithQuotaTag
ZwDeviceIoControlFile
RtlUnicodeStringToInteger
RtlClearAllBits
PsGetCurrentProcessId
KeInitializeTimerEx
ExLocalTimeToSystemTime
RtlInitializeSid
MmUnlockPagableImageSection
IoGetRelatedDeviceObject
ZwQueryKey
IoSetDeviceInterfaceState
RtlCharToInteger
RtlUnicodeToMultiByteN
IoGetDmaAdapter
ZwOpenProcess
FsRtlFreeFileLock
ZwAllocateVirtualMemory
KeStackAttachProcess
RtlGUIDFromString
IoIsWdmVersionAvailable
IoQueueWorkItem
RtlCompareUnicodeString
IoDeviceObjectType
IoGetDeviceInterfaceAlias
KeReleaseMutex
IoGetCurrentProcess
FsRtlGetNextFileLock
IoAllocateErrorLogEntry
CcRemapBcb
IoAllocateMdl
ZwFlushKey
KeInitializeSpinLock
FsRtlAllocateFileLock
RtlDowncaseUnicodeString
ExDeleteNPagedLookasideList
RtlCopyUnicodeString
ZwReadFile
IoGetBootDiskInformation
MmAllocateNonCachedMemory
RtlEnumerateGenericTable
ZwMakeTemporaryObject
SeTokenIsAdmin
RtlCheckRegistryKey
IoUpdateShareAccess
ExAcquireFastMutexUnsafe
SeSinglePrivilegeCheck
RtlFindLastBackwardRunClear
RtlFindLongestRunClear
IoCheckEaBufferValidity
ZwOpenFile
IoSetHardErrorOrVerifyDevice
MmUnmapIoSpace
PsCreateSystemThread
RtlPrefixUnicodeString
ZwDeleteKey
RtlSubAuthoritySid
ZwQueryObject
ExReleaseResourceLite
MmIsAddressValid
MmIsDriverVerifying
IoMakeAssociatedIrp
KeSetBasePriorityThread
ExReleaseFastMutexUnsafe
IoGetDeviceInterfaces
ExSetResourceOwnerPointer
FsRtlIsDbcsInExpression
KeReleaseSemaphore
KeSetPriorityThread
KeFlushQueuedDpcs
FsRtlMdlWriteCompleteDev
RtlNumberOfClearBits
ExGetPreviousMode
KePulseEvent
MmQuerySystemSize
IoCreateSynchronizationEvent
PsTerminateSystemThread
IoGetAttachedDevice
ProbeForWrite
ExDeletePagedLookasideList
ExSystemTimeToLocalTime
KeQueryActiveProcessors
RtlSecondsSince1980ToTime
KeGetCurrentThread
KeQueryInterruptTime
MmAllocateContiguousMemory
ZwQueryInformationFile
IoRemoveShareAccess
RtlValidSid
IoFreeController
SeImpersonateClientEx
CcDeferWrite
RtlFindClearBitsAndSet
IoCheckShareAccess
RtlUpperString
PoCallDriver
KeEnterCriticalRegion
IoStartNextPacket
RtlInitUnicodeString
CcFastCopyRead
ExGetExclusiveWaiterCount
RtlSetDaclSecurityDescriptor
KdEnableDebugger
FsRtlIsHpfsDbcsLegal
KeWaitForSingleObject
RtlInitializeUnicodePrefix
IoWMIRegistrationControl
IoGetDeviceToVerify
CcSetBcbOwnerPointer
IoAcquireCancelSpinLock
IoCreateDevice
FsRtlFastCheckLockForRead
IoCheckQuotaBufferValidity
PoRequestPowerIrp
KeRemoveEntryDeviceQueue
ExFreePool
CcCopyRead
RtlCreateSecurityDescriptor
MmCanFileBeTruncated
RtlDeleteRegistryValue
ZwFsControlFile
IoFreeWorkItem
IoInvalidateDeviceRelations
FsRtlDeregisterUncProvider
RtlTimeToTimeFields
MmSetAddressRangeModified
RtlUnicodeStringToAnsiString
IoConnectInterrupt
IoOpenDeviceRegistryKey
ZwQueryValueKey
RtlHashUnicodeString
MmResetDriverPaging
RtlInitializeBitMap
ExCreateCallback
IoSetThreadHardErrorMode
PsGetCurrentProcess
KeInitializeApc
KeInsertHeadQueue
CcUnpinDataForThread
RtlFreeAnsiString
SeQueryInformationToken
FsRtlFastUnlockSingle
RtlFindLeastSignificantBit
ExFreePoolWithTag
ZwFreeVirtualMemory
PoSetPowerState
IoGetDeviceObjectPointer
RtlFindClearRuns
RtlCopyLuid
IoAllocateWorkItem
ExRaiseAccessViolation
MmSecureVirtualMemory
RtlSetAllBits
PoSetSystemState
ExReinitializeResourceLite
FsRtlIsNameInExpression
IoAttachDeviceToDeviceStack
IoDeleteController
FsRtlCheckLockForWriteAccess
FsRtlLookupLastLargeMcbEntry
MmFreePagesFromMdl
KeRegisterBugCheckCallback
RtlFindMostSignificantBit
KeInitializeDpc
CcZeroData
MmLockPagableDataSection
MmPageEntireDriver
RtlCreateRegistryKey
IoInitializeIrp
PsGetCurrentThread
RtlUpcaseUnicodeString
ZwDeleteValueKey
MmForceSectionClosed
RtlAddAccessAllowedAceEx
SeTokenIsRestricted
KeSetTimer
RtlSetBits
IoReleaseCancelSpinLock
RtlInitializeGenericTable
KeDelayExecutionThread
PsGetCurrentThreadId
KeSetEvent
KeCancelTimer
RtlxUnicodeStringToAnsiSize
KeDeregisterBugCheckCallback
RtlInsertUnicodePrefix
IoGetStackLimits
ZwCreateFile
RtlTimeToSecondsSince1970
PoStartNextPowerIrp
IoIsSystemThread
RtlCreateUnicodeString
KeQueryTimeIncrement
ZwCreateDirectoryObject
KeRemoveQueue
KeRundownQueue
RtlLengthRequiredSid
KeInitializeDeviceQueue
IoFreeMdl
KeBugCheck
ZwCreateSection
MmHighestUserAddress
KeReadStateTimer
KeBugCheckEx
FsRtlNotifyInitializeSync
IoReuseIrp
ExGetSharedWaiterCount
RtlAreBitsClear
CcFastCopyWrite
ExUnregisterCallback
RtlDeleteNoSplay
FsRtlIsFatDbcsLegal
ZwOpenKey
RtlUpcaseUnicodeChar
ZwEnumerateValueKey
KeInitializeSemaphore
RtlGetVersion
ExVerifySuite
ExDeleteResourceLite
ExUuidCreate
FsRtlCheckLockForReadAccess
IoStartTimer
PsLookupThreadByThreadId
MmMapLockedPagesSpecifyCache
KeRemoveQueueDpc
ObGetObjectSecurity
IoDisconnectInterrupt
ExNotifyCallback
PsDereferencePrimaryToken
IoGetRequestorProcessId
ZwMapViewOfSection
MmUnmapLockedPages
SeCreateClientSecurity
IoReportDetectedDevice
KeInsertByKeyDeviceQueue
SeQueryAuthenticationIdToken
ExAcquireResourceSharedLite
ObReferenceObjectByHandle
PsIsThreadTerminating
KeQuerySystemTime
IoCreateSymbolicLink
ProbeForRead
IoRequestDeviceEject
KeInitializeMutex
SeOpenObjectAuditAlarm
KeLeaveCriticalRegion
RtlFindUnicodePrefix
MmFreeNonCachedMemory
RtlVerifyVersionInfo
IoAllocateController
Sections
.text Size: 35KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 1024B - Virtual size: 546B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 640B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ