X:\JzpmAXjtdH\pLyjkbcduQmSl\swapScmoxypyd\sxXrnrYlziFfYs.pdb
Static task
static1
Behavioral task
behavioral1
Sample
606ec4069ac5eb3b06950d9079ee0250_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
606ec4069ac5eb3b06950d9079ee0250_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
606ec4069ac5eb3b06950d9079ee0250_JaffaCakes118
-
Size
331KB
-
MD5
606ec4069ac5eb3b06950d9079ee0250
-
SHA1
b29ede042758a29d1e6b95d1067f52b81e81d092
-
SHA256
29ca54886e87ca5bb7c9b17336ed4455c0110e67602c6d9c0c193de84c5c0663
-
SHA512
ed2f56aea21d3d4cfceb1b004e321847e876785a4eec00b15a41936d5c0d5d0307df2541945c54c9e48c1cc619fc36d73e66ad935591b210a2134165d12d7a39
-
SSDEEP
6144:IIsR+gPCuLj5la/n/jtglEoa4vHg+u83lyn1q+/jst8KHfjIckkQYdWihh19:9sR+g6u3a6lZa4fg+e1q+/4ttHfjIc7Z
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 606ec4069ac5eb3b06950d9079ee0250_JaffaCakes118
Files
-
606ec4069ac5eb3b06950d9079ee0250_JaffaCakes118.dll windows:5 windows x86 arch:x86
dbee48f72b3673fdf8617ccc0390cc50
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlInitUnicodeString
RtlEqualString
KeRemoveByKeyDeviceQueue
KeRemoveQueue
RtlInitString
ExFreePoolWithTag
MmIsAddressValid
RtlFindNextForwardRunClear
ZwFsControlFile
CcIsThereDirtyData
IoAllocateIrp
PoSetSystemState
strcat
RtlUpperChar
FsRtlGetNextFileLock
RtlDeleteRegistryValue
ExGetPreviousMode
RtlCreateRegistryKey
RtlIntegerToUnicodeString
RtlSetBits
RtlAppendStringToString
RtlInsertUnicodePrefix
ZwQueryInformationFile
RtlEqualUnicodeString
KeSetImportanceDpc
RtlFillMemoryUlong
RtlCompareString
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 728B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ