L:\gRlStmuz\AtbNdauAebqc\EfcolEFfi.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6259bf4777bef035bdebbbd9d450e91d_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6259bf4777bef035bdebbbd9d450e91d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6259bf4777bef035bdebbbd9d450e91d_JaffaCakes118
-
Size
267KB
-
MD5
6259bf4777bef035bdebbbd9d450e91d
-
SHA1
6684f30301c8a76cca23ba38352db9f32ea1cee6
-
SHA256
141e0f3917f4836fb422e45ba31e754b1a9c8844134e5bb6aad1b993ccbc7cb6
-
SHA512
8334ace3b499932ded9cba502c5141d5ce73c40f9a7cec182f2ba656de3b8cb5dd50e5cb7024e3ccd5bd093aef2af69877f00b89feb11d9fec0e0eb288164cf8
-
SSDEEP
6144:ycKb5iovKwVwette322cmfGSwk/Nj1uni:zsEoWKCLOS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6259bf4777bef035bdebbbd9d450e91d_JaffaCakes118
Files
-
6259bf4777bef035bdebbbd9d450e91d_JaffaCakes118.dll windows:5 windows x86 arch:x86
f7ecce26f81db4d277da7c0b65d9fc55
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
MmUnmapIoSpace
MmSecureVirtualMemory
IoAllocateController
FsRtlLookupLastLargeMcbEntry
IoFreeMdl
CcSetBcbOwnerPointer
CcCopyWrite
KeReleaseSemaphore
KeRemoveDeviceQueue
ExGetExclusiveWaiterCount
ZwQueryVolumeInformationFile
PsDereferencePrimaryToken
IoStartPacket
IoDetachDevice
RtlDeleteElementGenericTable
RtlFillMemoryUlong
RtlInitializeSid
PsChargeProcessPoolQuota
SeUnlockSubjectContext
ExAllocatePoolWithQuotaTag
ObQueryNameString
MmProbeAndLockPages
KeReadStateEvent
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForWrite
KeInsertQueue
KeWaitForSingleObject
IoFreeIrp
IoRegisterFileSystem
KeInitializeTimerEx
RtlFreeAnsiString
RtlIntegerToUnicodeString
RtlCompareString
MmMapLockedPagesSpecifyCache
RtlLengthRequiredSid
MmUnlockPages
RtlRemoveUnicodePrefix
IoReleaseRemoveLockAndWaitEx
KeInitializeDeviceQueue
RtlSecondsSince1970ToTime
CcPurgeCacheSection
PsGetProcessExitTime
KeReadStateTimer
RtlAddAccessAllowedAce
ExRaiseAccessViolation
ObfDereferenceObject
ExAllocatePool
ZwSetSecurityObject
RtlFindClearBits
RtlUpcaseUnicodeChar
RtlEnumerateGenericTable
MmMapUserAddressesToPage
RtlAnsiCharToUnicodeChar
MmGetSystemRoutineAddress
MmLockPagableDataSection
ExAllocatePoolWithQuota
ExUnregisterCallback
PsSetLoadImageNotifyRoutine
MmIsVerifierEnabled
IoRaiseHardError
CcUninitializeCacheMap
CcSetReadAheadGranularity
MmAllocateNonCachedMemory
IoReadPartitionTable
RtlCheckRegistryKey
KeSaveFloatingPointState
KeInitializeMutex
KeQueryTimeIncrement
RtlUnicodeStringToInteger
MmForceSectionClosed
ExUuidCreate
IoSetStartIoAttributes
IoRequestDeviceEject
KeQueryActiveProcessors
IoCreateStreamFileObject
PsGetProcessId
IoDeviceObjectType
IoCreateStreamFileObjectLite
HalExamineMBR
PsTerminateSystemThread
ExRaiseStatus
ProbeForRead
RtlCopyString
MmAddVerifierThunks
RtlVolumeDeviceToDosName
RtlIsNameLegalDOS8Dot3
ZwReadFile
RtlCopyUnicodeString
RtlCreateRegistryKey
IoWMIRegistrationControl
PoUnregisterSystemState
ExAcquireFastMutexUnsafe
IoGetRequestorProcess
CcMdlWriteAbort
ObOpenObjectByPointer
CcDeferWrite
MmMapIoSpace
KeBugCheck
RtlGetCallersAddress
IoAllocateErrorLogEntry
KeInsertHeadQueue
RtlSplay
RtlNtStatusToDosError
ExDeleteNPagedLookasideList
RtlFindLastBackwardRunClear
KeInitializeApc
IoGetAttachedDevice
ExCreateCallback
IoGetBootDiskInformation
KeClearEvent
KeLeaveCriticalRegion
RtlCompareMemory
MmFlushImageSection
ExReinitializeResourceLite
RtlInitAnsiString
KdEnableDebugger
IoReleaseVpbSpinLock
RtlValidSid
SeAppendPrivileges
RtlDeleteNoSplay
RtlxOemStringToUnicodeSize
RtlPrefixUnicodeString
CcFlushCache
IoGetDeviceProperty
RtlEqualString
ZwQueryKey
MmLockPagableSectionByHandle
ZwMakeTemporaryObject
MmPageEntireDriver
MmSetAddressRangeModified
ZwQuerySymbolicLinkObject
RtlQueryRegistryValues
IoDisconnectInterrupt
RtlInitUnicodeString
RtlUpperString
FsRtlFreeFileLock
KeDetachProcess
CcCopyRead
MmHighestUserAddress
KeQuerySystemTime
CcFastMdlReadWait
PoSetPowerState
ZwClose
IoSetTopLevelIrp
FsRtlIsNameInExpression
KeInsertDeviceQueue
IoSetThreadHardErrorMode
IoGetLowerDeviceObject
IoReuseIrp
IoDeleteSymbolicLink
FsRtlFastCheckLockForRead
FsRtlIsHpfsDbcsLegal
MmAdvanceMdl
ObInsertObject
KeSetSystemAffinityThread
RtlEqualSid
CcMdlWriteComplete
RtlSetAllBits
IoAcquireCancelSpinLock
SeQueryInformationToken
IoFreeErrorLogEntry
IoAcquireRemoveLockEx
MmResetDriverPaging
IoGetDeviceInterfaceAlias
FsRtlIsDbcsInExpression
RtlInt64ToUnicodeString
IoCreateFile
IoIsOperationSynchronous
KeRestoreFloatingPointState
IoEnumerateDeviceObjectList
IoGetDeviceAttachmentBaseRef
RtlTimeToTimeFields
ZwOpenProcess
CcUnpinDataForThread
RtlInitializeUnicodePrefix
KeSetTimerEx
KeSetEvent
IoCheckQuotaBufferValidity
IoReportResourceForDetection
CcCanIWrite
RtlFreeUnicodeString
PsReturnPoolQuota
DbgPrompt
RtlLengthSid
ZwOpenKey
IoFreeController
ZwCreateSection
IoIsWdmVersionAvailable
IoInitializeIrp
RtlInitializeGenericTable
KeInsertByKeyDeviceQueue
RtlAddAccessAllowedAceEx
ExAllocatePoolWithTag
KeSetPriorityThread
RtlUnicodeStringToOemString
ZwFlushKey
SeDeassignSecurity
RtlInitializeBitMap
IoWMIWriteEvent
KeInitializeEvent
IoDeleteController
RtlFindNextForwardRunClear
IoCreateNotificationEvent
RtlUpcaseUnicodeToOemN
ZwOpenSection
RtlMultiByteToUnicodeN
ZwFsControlFile
KePulseEvent
IoIsSystemThread
KeReadStateSemaphore
FsRtlAllocateFileLock
DbgBreakPoint
IoInvalidateDeviceState
CcFastCopyRead
ExSystemTimeToLocalTime
IoBuildSynchronousFsdRequest
ZwFreeVirtualMemory
PoRegisterSystemState
MmFreeMappingAddress
ZwQueryValueKey
MmSizeOfMdl
MmIsAddressValid
PoStartNextPowerIrp
FsRtlIsTotalDeviceFailure
CcIsThereDirtyData
KeInitializeDpc
ObCreateObject
IoSetPartitionInformation
KeBugCheckEx
RtlExtendedIntegerMultiply
IoWriteErrorLogEntry
KeAttachProcess
ExVerifySuite
MmGetPhysicalAddress
MmAllocateContiguousMemory
RtlFindMostSignificantBit
ExReleaseResourceLite
IoCancelIrp
IoSetShareAccess
KeInitializeQueue
RtlFindUnicodePrefix
RtlStringFromGUID
ExLocalTimeToSystemTime
RtlFindSetBits
IoReadDiskSignature
PoSetSystemState
ExAcquireResourceSharedLite
MmFreePagesFromMdl
ZwDeviceIoControlFile
IoReadPartitionTableEx
KeRemoveQueueDpc
ExIsProcessorFeaturePresent
MmFreeContiguousMemory
ZwEnumerateKey
ZwOpenSymbolicLinkObject
RtlValidSecurityDescriptor
SeSinglePrivilegeCheck
Exports
Exports
?GetWindowInfoExA@@YGMPADPAMEJ&U
?CloseComponentExA@@YGEH_NPAEE&U
?GetPointerW@@YG_NPAII&U
?ValidateWindowExW@@YGPAXPAIIGE&U
?FormatCommandLineExA@@YGPAEKM&U
?GenerateMutantOld@@YGPAHJPAMPAEK&U
?FreeFileEx@@YGPAKIJF&U
?IsAppNameA@@YGPAXHFDK&U
?IsDialog@@YGPAMG&U
?InvalidateCharExA@@YGXJGPAJF&U
?CancelDeviceExW@@YGMPAJPAE&U
?InsertExpressionOld@@YGDF&U
?PutComponentOriginal@@YGKPAHD&U
?InstallExpression@@YGMGDIG&U
?CallProviderNew@@YGFFPAIIPAK&U
?PutMutexExA@@YGDDPAI&U
?CancelDateTimeExA@@YGPAXKPANJ&U
?FindExpressionExW@@YGPAHJ&U
?CallAppNameNew@@YGHJFG&U
?EnumProfileOld@@YGPADJH&U
?RemoveFolderExA@@YGXD&U
?FreeScreenEx@@YGIKMD&U
?FreeProfileOriginal@@YGKPAHPAKPAGG&U
?GenerateKeyboardA@@YGXPAGKHE&U
?ModifySection@@YGDPAMMD&U
?CloseObjectExA@@YGJD&U
?InstallObjectW@@YGEPAGKKJ&U
?ValidateHeaderOriginal@@YGPAGG&U
?ValidateKeyboardExW@@YGPAXNI&U
?GetDirectoryExW@@YGNIPAFFPAI&U
?OnCommandLine@@YG_NHNNPAM&U
?AddMonitor@@YGPAFGE&U
?AddRect@@YGHPAMPA_N&U
?DecrementDateTimeNew@@YGGKHPAJ&U
Sections
.text Size: 30KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 660B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ