H:\yjbPpgHjCqyDdt\iSbssvvzs\fsaPsfBip\gpfOaufG.pdb
Static task
static1
Behavioral task
behavioral1
Sample
604052e35667c7e57b5be516e15b649c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
604052e35667c7e57b5be516e15b649c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
604052e35667c7e57b5be516e15b649c_JaffaCakes118
-
Size
61KB
-
MD5
604052e35667c7e57b5be516e15b649c
-
SHA1
ab40e629d770b1d87817aa2ac16a341dda8030c1
-
SHA256
6321ce747c4a8ab5888bd3e4baf08a3d4168f5788661b0f4793d682d50040cd9
-
SHA512
9cf72f6a97f364c7188c5464f741c8689311e3c6106766dc1a315cce5b04453daf30a741e6597b67f20d151611935decdd68fc9f80a5b6f942b24f0a1d9ab1d9
-
SSDEEP
768:6Q4AT6FFQkHwcm/9lOglc6D5OmmMeO48P/7mnJZQD3aIqxG4/DEvggjd2mrvm:F4I6/QQVsMYOeZCnUzaIq2VjdR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 604052e35667c7e57b5be516e15b649c_JaffaCakes118
Files
-
604052e35667c7e57b5be516e15b649c_JaffaCakes118.dll windows:5 windows x86 arch:x86
300dc7751b9ad02a4d258882aaba42aa
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
CcInitializeCacheMap
ExGetPreviousMode
PsGetCurrentThread
RtlValidSecurityDescriptor
ZwReadFile
MmAddVerifierThunks
IoRemoveShareAccess
CcUnpinRepinnedBcb
SeQueryAuthenticationIdToken
ZwSetValueKey
RtlLengthSecurityDescriptor
IoInitializeIrp
IoAllocateErrorLogEntry
ExReleaseResourceLite
ProbeForWrite
SeAccessCheck
RtlSplay
ExAllocatePoolWithQuotaTag
RtlAnsiStringToUnicodeString
RtlQueryRegistryValues
PsImpersonateClient
SeImpersonateClientEx
RtlAreBitsSet
ExDeleteNPagedLookasideList
FsRtlCheckLockForReadAccess
IoGetDeviceInterfaces
RtlUnicodeStringToOemString
RtlAddAccessAllowedAce
ZwFsControlFile
RtlxAnsiStringToUnicodeSize
IoCheckShareAccess
ZwUnloadDriver
PsGetVersion
IoSetDeviceToVerify
IofCompleteRequest
CcCopyWrite
RtlEqualString
RtlCompareString
ZwMakeTemporaryObject
KeSetPriorityThread
FsRtlMdlWriteCompleteDev
IoCreateNotificationEvent
ExRaiseAccessViolation
IoStopTimer
IoQueryDeviceDescription
MmUnsecureVirtualMemory
IoGetRelatedDeviceObject
ZwAllocateVirtualMemory
ZwQueryVolumeInformationFile
ExGetSharedWaiterCount
RtlGetVersion
FsRtlIsNameInExpression
IoReleaseCancelSpinLock
KeDeregisterBugCheckCallback
IoWriteErrorLogEntry
KeQuerySystemTime
ZwCreateKey
CcSetDirtyPinnedData
RtlAnsiCharToUnicodeChar
RtlEqualSid
IoStartPacket
IofCallDriver
KeSetSystemAffinityThread
RtlVolumeDeviceToDosName
IoIsSystemThread
KeAttachProcess
ExAllocatePoolWithQuota
KeSetImportanceDpc
RtlSetAllBits
IoStartNextPacket
KeRundownQueue
KeSaveFloatingPointState
IoGetDeviceProperty
IoCreateStreamFileObjectLite
IoGetTopLevelIrp
ProbeForRead
IoRaiseHardError
RtlUpcaseUnicodeString
IoCreateDisk
RtlCreateSecurityDescriptor
IoDeleteDevice
ZwLoadDriver
MmResetDriverPaging
IoAcquireRemoveLockEx
KeRemoveEntryDeviceQueue
ExSystemTimeToLocalTime
MmLockPagableDataSection
RtlClearBits
VerSetConditionMask
RtlFindLastBackwardRunClear
FsRtlIsDbcsInExpression
ZwEnumerateKey
IoCsqRemoveIrp
MmIsThisAnNtAsSystem
ObInsertObject
DbgBreakPointWithStatus
IoAcquireCancelSpinLock
KdDisableDebugger
KeSetEvent
ExDeleteResourceLite
MmIsDriverVerifying
KeRemoveQueueDpc
IoInitializeTimer
KeResetEvent
KeClearEvent
PsGetThreadProcessId
RtlUpcaseUnicodeChar
IoGetDmaAdapter
IoFreeMdl
IoAllocateWorkItem
MmSecureVirtualMemory
CcMdlWriteComplete
ZwDeviceIoControlFile
IoMakeAssociatedIrp
IoGetLowerDeviceObject
RtlOemStringToUnicodeString
PoCallDriver
RtlFindNextForwardRunClear
RtlCopyUnicodeString
ZwOpenFile
MmForceSectionClosed
ExUnregisterCallback
MmMapIoSpace
RtlMultiByteToUnicodeN
PoRegisterSystemState
IoGetDriverObjectExtension
IoCheckEaBufferValidity
IoDeleteSymbolicLink
ZwClose
PsIsThreadTerminating
MmGetPhysicalAddress
RtlClearAllBits
CcMdlReadComplete
MmAllocateNonCachedMemory
IoReportDetectedDevice
ObfReferenceObject
IoGetAttachedDeviceReference
KeSetTimerEx
IoRegisterFileSystem
CcMdlWriteAbort
RtlUpcaseUnicodeToOemN
ZwFlushKey
KeInitializeQueue
KeInsertQueueDpc
PoUnregisterSystemState
ZwOpenKey
MmGetSystemRoutineAddress
SeTokenIsRestricted
KeReadStateEvent
ExLocalTimeToSystemTime
IoSetHardErrorOrVerifyDevice
ExSetTimerResolution
ZwEnumerateValueKey
IoWMIRegistrationControl
RtlNtStatusToDosError
RtlInitAnsiString
MmUnlockPages
FsRtlIsTotalDeviceFailure
IoGetDeviceInterfaceAlias
ZwOpenSection
RtlDeleteNoSplay
MmIsVerifierEnabled
ExUuidCreate
RtlDeleteElementGenericTable
MmAllocatePagesForMdl
RtlAppendUnicodeToString
PsGetProcessExitTime
KeInitializeSpinLock
ZwSetVolumeInformationFile
IoSetTopLevelIrp
RtlInitializeBitMap
FsRtlNotifyInitializeSync
RtlEqualUnicodeString
RtlFindClearBitsAndSet
IoDeviceObjectType
IoFreeIrp
IoQueryFileDosDeviceName
KeLeaveCriticalRegion
IoCreateFile
RtlInsertUnicodePrefix
IoWritePartitionTableEx
ExFreePoolWithTag
RtlSecondsSince1970ToTime
CcUnpinData
MmMapLockedPagesSpecifyCache
IoThreadToProcess
SeDeleteObjectAuditAlarm
RtlRandom
RtlCopyLuid
RtlTimeFieldsToTime
RtlxOemStringToUnicodeSize
MmAllocateMappingAddress
IoSetThreadHardErrorMode
ObQueryNameString
PoSetSystemState
KeInitializeTimer
IoReadPartitionTable
ObMakeTemporaryObject
CcPurgeCacheSection
IoGetBootDiskInformation
RtlCopyString
MmProbeAndLockPages
CcFastMdlReadWait
KeBugCheckEx
ObGetObjectSecurity
IoDetachDevice
RtlFindLeastSignificantBit
CcSetFileSizes
SeDeassignSecurity
KeRestoreFloatingPointState
ObCreateObject
IoDeleteController
SeLockSubjectContext
IoIsWdmVersionAvailable
HalExamineMBR
IoOpenDeviceRegistryKey
FsRtlCheckOplock
KeEnterCriticalRegion
PsSetLoadImageNotifyRoutine
KeQueryActiveProcessors
RtlInitializeGenericTable
MmFreeContiguousMemory
ExInitializeResourceLite
ZwCreateFile
PsLookupThreadByThreadId
KeSetBasePriorityThread
IoAllocateController
ExReinitializeResourceLite
MmHighestUserAddress
ExQueueWorkItem
ZwCreateDirectoryObject
KeInsertQueue
RtlCopySid
KeWaitForMultipleObjects
ExSetResourceOwnerPointer
MmFreePagesFromMdl
KeReadStateSemaphore
FsRtlCheckLockForWriteAccess
RtlFindSetBits
RtlGenerate8dot3Name
KeRemoveQueue
SeAssignSecurity
RtlCompareMemory
KeStackAttachProcess
MmAdvanceMdl
RtlHashUnicodeString
IoFreeErrorLogEntry
IoCreateDevice
RtlFreeOemString
ExReleaseFastMutexUnsafe
MmBuildMdlForNonPagedPool
CcFastCopyRead
MmFreeMappingAddress
KeInitializeSemaphore
KeSetKernelStackSwapEnable
CcSetReadAheadGranularity
RtlAppendStringToString
FsRtlNotifyUninitializeSync
RtlxUnicodeStringToAnsiSize
RtlSecondsSince1980ToTime
RtlWriteRegistryValue
ObReferenceObjectByPointer
Exports
Exports
?RtlKeyboardOriginal@@YGEJ[W
?GenerateHeightExA@@YGGPAJEPAHJ[W
?ModifyFilePathEx@@YGDPAEPAGPAK[W
?LoadFullNameNew@@YGPAFNK[W
?RtlSectionA@@YGJPANPAEN[W
?CloseFolderPathExA@@YGMPAK[W
?ShowHeaderEx@@YGGMDGPA_N[W
?GenerateWidthExW@@YGGPAGHNE[W
?OnProviderOld@@YGXD[W
?PutFunctionEx@@YG_NI_NJG[W
?IncrementStateExW@@YGNPAGD[W
?ShowDataNew@@YGXEJ[W
?CloseCommandLineW@@YGPAMJH[W
?HideThreadNew@@YGND[W
?RemoveObjectW@@YGHPAEKPADPAE[W
?ShowPointExA@@YGGPAKPAMPAG[W
?InvalidateProviderEx@@YGIF[W
?AddDataEx@@YGXJ[W
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 58KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ