U:\oiXkbgqdeWqTMv\inkpbha\ZrHmMaDhnpzosr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4cd16474dbd6f71f8592052f388d9ef9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4cd16474dbd6f71f8592052f388d9ef9_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
4cd16474dbd6f71f8592052f388d9ef9_JaffaCakes118
-
Size
234KB
-
MD5
4cd16474dbd6f71f8592052f388d9ef9
-
SHA1
eafd686c0d12307e03b5530356da382bbceee7a9
-
SHA256
38883c5c75bfa30ed57e293a0f54e19c875d04dd7010352bf12ca9d516e5c9b4
-
SHA512
6a066703a53766ba848d972c4665453ca12aef6ea061ad3b8da414bc91c03c89fcdc7f48e5c93a3da8bec764f46f3967f45ecbc61ba895de2456b1d3f3f5bc17
-
SSDEEP
3072:KVw2xCfQlgfaLYTSfRt9aT3hMeqVb/1ttLQcJpUum/UQ/Gis5nAY9BBA3kNmCIv5:idxCfagfyAhcH9tm/t/G5tBRmCIvqK
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4cd16474dbd6f71f8592052f388d9ef9_JaffaCakes118
Files
-
4cd16474dbd6f71f8592052f388d9ef9_JaffaCakes118.dll windows:5 windows x86 arch:x86
889cb085db955729c65420bdb33c30d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
SeImpersonateClientEx
IoRegisterDeviceInterface
VerSetConditionMask
ExSetTimerResolution
ExNotifyCallback
KeSetTimerEx
IoOpenDeviceRegistryKey
KeDelayExecutionThread
KeInitializeTimerEx
IoBuildPartialMdl
RtlAreBitsClear
IoCheckShareAccess
SeTokenIsAdmin
FsRtlIsHpfsDbcsLegal
CcCopyWrite
MmSecureVirtualMemory
RtlAddAccessAllowedAceEx
SeReleaseSubjectContext
MmMapLockedPages
RtlSetDaclSecurityDescriptor
PoSetPowerState
IoQueryDeviceDescription
KeRundownQueue
IoWritePartitionTableEx
MmSizeOfMdl
IoCreateDevice
ObReferenceObjectByHandle
KdEnableDebugger
IoReportDetectedDevice
IoGetAttachedDeviceReference
KeInitializeQueue
SeTokenIsRestricted
ExVerifySuite
RtlDeleteNoSplay
RtlUnicodeStringToAnsiString
IoFreeIrp
ZwOpenKey
IoReleaseCancelSpinLock
RtlValidSecurityDescriptor
RtlDelete
ZwQuerySymbolicLinkObject
FsRtlFastUnlockSingle
IoInitializeIrp
PoCallDriver
IoConnectInterrupt
ZwQueryValueKey
RtlTimeFieldsToTime
PsIsThreadTerminating
IoGetDeviceToVerify
RtlFindNextForwardRunClear
SePrivilegeCheck
ObInsertObject
CcInitializeCacheMap
FsRtlFreeFileLock
ZwQueryInformationFile
MmIsVerifierEnabled
FsRtlCheckLockForWriteAccess
CcSetBcbOwnerPointer
ExRaiseDatatypeMisalignment
ExRegisterCallback
RtlAnsiCharToUnicodeChar
ZwNotifyChangeKey
KeReadStateEvent
RtlOemToUnicodeN
RtlFindLongestRunClear
IoReleaseRemoveLockAndWaitEx
PoRegisterSystemState
RtlCreateSecurityDescriptor
MmAllocateMappingAddress
ZwFreeVirtualMemory
MmAllocateContiguousMemory
KeInitializeSemaphore
SeAppendPrivileges
IoGetDeviceAttachmentBaseRef
FsRtlAllocateFileLock
FsRtlCheckOplock
IoGetDriverObjectExtension
KeResetEvent
FsRtlLookupLastLargeMcbEntry
CcFastMdlReadWait
PsGetProcessId
IoDeleteController
RtlAreBitsSet
SeAssignSecurity
IoReadDiskSignature
CcPurgeCacheSection
IoCreateSynchronizationEvent
ZwOpenProcess
RtlFreeUnicodeString
RtlNtStatusToDosError
ObMakeTemporaryObject
SeDeassignSecurity
RtlVerifyVersionInfo
ProbeForRead
RtlInsertUnicodePrefix
RtlCharToInteger
RtlFindMostSignificantBit
MmIsThisAnNtAsSystem
ZwEnumerateValueKey
RtlFillMemoryUlong
KeDetachProcess
RtlTimeToSecondsSince1970
PsGetProcessExitTime
ExLocalTimeToSystemTime
KeWaitForSingleObject
RtlInitializeUnicodePrefix
IoQueueWorkItem
RtlInitString
CcMdlRead
IoAllocateAdapterChannel
RtlGenerate8dot3Name
IoEnumerateDeviceObjectList
RtlEqualSid
IofCompleteRequest
ExGetSharedWaiterCount
MmAllocateNonCachedMemory
CcCanIWrite
RtlQueryRegistryValues
KeRegisterBugCheckCallback
KeStackAttachProcess
KeSetKernelStackSwapEnable
MmUnsecureVirtualMemory
IoGetLowerDeviceObject
MmFreeNonCachedMemory
DbgBreakPointWithStatus
PsTerminateSystemThread
ZwMakeTemporaryObject
IoGetDeviceInterfaces
RtlFreeAnsiString
RtlVolumeDeviceToDosName
RtlMultiByteToUnicodeN
CcDeferWrite
IoAllocateMdl
KeUnstackDetachProcess
IoAllocateErrorLogEntry
CcMdlWriteComplete
IoQueryFileDosDeviceName
PsGetCurrentProcessId
RtlClearAllBits
RtlUnicodeToMultiByteN
IoIsOperationSynchronous
KeRemoveDeviceQueue
RtlEqualString
IoGetDeviceObjectPointer
IoCheckEaBufferValidity
RtlUnicodeToOemN
CcUnpinRepinnedBcb
MmProbeAndLockPages
KeAttachProcess
RtlFindClearBits
IoSetDeviceInterfaceState
IoCreateStreamFileObjectLite
KeRemoveEntryDeviceQueue
ObCreateObject
RtlExtendedIntegerMultiply
RtlTimeToTimeFields
IoFreeErrorLogEntry
IoSetShareAccess
RtlFindUnicodePrefix
RtlFindClearRuns
MmForceSectionClosed
RtlLengthRequiredSid
SeFreePrivileges
IoSetSystemPartition
MmHighestUserAddress
ZwOpenFile
RtlCreateRegistryKey
IoCreateStreamFileObject
ExUnregisterCallback
IoFreeController
RtlTimeToSecondsSince1980
MmGetPhysicalAddress
FsRtlNotifyInitializeSync
CcFastCopyRead
ExReleaseFastMutexUnsafe
RtlClearBits
RtlCopyUnicodeString
ExReleaseResourceLite
IoIsWdmVersionAvailable
SeValidSecurityDescriptor
IoSetPartitionInformationEx
CcPinRead
DbgBreakPoint
FsRtlIsNameInExpression
IoSetPartitionInformation
ExDeleteNPagedLookasideList
MmPageEntireDriver
ZwCreateFile
MmFreePagesFromMdl
KefAcquireSpinLockAtDpcLevel
CcMdlWriteAbort
ExAllocatePool
ZwSetSecurityObject
SeUnlockSubjectContext
CcSetReadAheadGranularity
KeInitializeEvent
IoRegisterFileSystem
IoGetRequestorProcess
IoGetCurrentProcess
RtlxOemStringToUnicodeSize
CcUnpinDataForThread
RtlInitializeGenericTable
IoGetBootDiskInformation
CcRepinBcb
RtlSubAuthoritySid
IoReportResourceForDetection
ExUuidCreate
IoCheckQuotaBufferValidity
KeRemoveQueue
RtlUpcaseUnicodeChar
MmAdvanceMdl
MmAddVerifierThunks
ZwCreateSection
RtlHashUnicodeString
RtlCopyLuid
IoCreateFile
RtlCopyString
FsRtlFastCheckLockForRead
KeBugCheck
IoStartNextPacket
ExAcquireFastMutexUnsafe
IoRequestDeviceEject
IoInvalidateDeviceState
RtlInt64ToUnicodeString
HalExamineMBR
IoCsqRemoveIrp
KeCancelTimer
MmUnmapLockedPages
IoSetThreadHardErrorMode
FsRtlGetNextFileLock
KeRemoveByKeyDeviceQueue
MmFlushImageSection
ZwLoadDriver
IoBuildSynchronousFsdRequest
RtlLengthSecurityDescriptor
FsRtlIsDbcsInExpression
IoAcquireRemoveLockEx
ExInitializeResourceLite
PsDereferencePrimaryToken
ZwDeleteKey
RtlCompareString
ZwMapViewOfSection
MmGetSystemRoutineAddress
IoStartTimer
IoThreadToProcess
ExAllocatePoolWithQuotaTag
KeSetTimer
RtlCompareUnicodeString
RtlRemoveUnicodePrefix
RtlInitAnsiString
IoAllocateWorkItem
ZwFlushKey
IoVerifyVolume
Exports
Exports
?HideTimeExW@@IJXM@X
?ValidateHeightEx@@IJINH@X
?CloseExpressionOld@@IJPAMGE@X
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vars1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vptr1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 564B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ