X:\JzpmAXjtdH\pLyjkbcduQmSl\swapScmoxypyd\sxXrnrYlziFfYs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
40c7d94c94548314f0f5bbab219750ed_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
40c7d94c94548314f0f5bbab219750ed_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
40c7d94c94548314f0f5bbab219750ed_JaffaCakes118
-
Size
49KB
-
MD5
40c7d94c94548314f0f5bbab219750ed
-
SHA1
f77bbdb73820b23ed3c191b5195ae68107fedf04
-
SHA256
8588af1dae51910bc8efa74a3280010d50fee1ebd6bdbb00b662f4447f1b4ff5
-
SHA512
7260f9ee956d2c20ff4679881d24cc26b7f786330a53ecde73943572449486cef958626b4b1348323d180e8aa35c1ac8117a5fb8685c024e584b2a39c4c810a4
-
SSDEEP
768:q0I2iwx0CDDcFI8jNrKS/lTzHyRaP3eksNUGEzoVZ3h4MO:q0I2hTAI8DlPyRaPd5hkVNO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40c7d94c94548314f0f5bbab219750ed_JaffaCakes118
Files
-
40c7d94c94548314f0f5bbab219750ed_JaffaCakes118.dll windows:5 windows x86 arch:x86
dbee48f72b3673fdf8617ccc0390cc50
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlEqualString
KeRemoveByKeyDeviceQueue
KeRemoveQueue
RtlInitString
ExFreePoolWithTag
MmIsAddressValid
RtlFindNextForwardRunClear
ZwFsControlFile
CcIsThereDirtyData
IoAllocateIrp
PoSetSystemState
strcat
RtlUpperChar
FsRtlGetNextFileLock
RtlDeleteRegistryValue
ExGetPreviousMode
RtlCreateRegistryKey
RtlIntegerToUnicodeString
RtlSetBits
RtlAppendStringToString
RtlInsertUnicodePrefix
ZwQueryInformationFile
RtlEqualUnicodeString
KeSetImportanceDpc
RtlFillMemoryUlong
RtlCompareString
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ