K:\nxndfCg\ryzwzgtGJara\DcxnmovgGtxC\gzAoNmtanJor\QHdstfUcpT.pdb
Static task
static1
Behavioral task
behavioral1
Sample
5b49a8303f82139a3d45492bc302cffa_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5b49a8303f82139a3d45492bc302cffa_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
5b49a8303f82139a3d45492bc302cffa_JaffaCakes118
-
Size
183KB
-
MD5
5b49a8303f82139a3d45492bc302cffa
-
SHA1
6f4461d62f571a4126f1e21356b9f9c293c27d7c
-
SHA256
6fc8861b766dfd5013fb15a7d96cc8f8607b19f19c323091e2af3af84a4ddaf7
-
SHA512
b0ccbc06f565ec42fdde3fa106f2da2026276fb13da8be9cb1ffe8f8df904c95f211d28cac8e1fa2650844678fddcd10accd45f6ba134e819317d3be8442530f
-
SSDEEP
3072:kexFDoUhy0Lp5hKT7uVW0egfexWlyK4yOTFO+HLJJedbVTQiJTfZl:kexFDoCyE5qy4gACyZTFOELDqTJr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5b49a8303f82139a3d45492bc302cffa_JaffaCakes118
Files
-
5b49a8303f82139a3d45492bc302cffa_JaffaCakes118.dll windows:5 windows x86 arch:x86
77cd558663435e4aab23416613cb357e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
MmIsAddressValid
RtlInitAnsiString
RtlUpcaseUnicodeString
RtlInitString
RtlSetDaclSecurityDescriptor
RtlTimeToTimeFields
RtlUpcaseUnicodeToOemN
RtlEqualUnicodeString
KeInsertQueue
RtlInitUnicodeString
RtlCopySid
IoInvalidateDeviceRelations
IoGetRequestorProcessId
ExReinitializeResourceLite
MmPageEntireDriver
ObReferenceObjectByHandle
KeWaitForMultipleObjects
MmAllocateNonCachedMemory
KeInsertByKeyDeviceQueue
RtlEqualString
RtlFindLeastSignificantBit
SeOpenObjectAuditAlarm
RtlxAnsiStringToUnicodeSize
RtlAreBitsSet
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idat Size: 512B - Virtual size: 100B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 734B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ztest Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.stest Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.init Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.srdat Size: 1024B - Virtual size: 580B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ