E:\xsjSjlkokMql\patRQknBhyjnw\fgjxbziB\fmmrgqpdC.pdb
Static task
static1
Behavioral task
behavioral1
Sample
63b36771a117aef79e1fad77a6e300fe_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
63b36771a117aef79e1fad77a6e300fe_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
63b36771a117aef79e1fad77a6e300fe_JaffaCakes118
-
Size
446KB
-
MD5
63b36771a117aef79e1fad77a6e300fe
-
SHA1
ba31c5f0097e732548e4a1cd73ce5700b233407d
-
SHA256
e9c5cc5629c5cd110f14e929dab396047b6213d98bbb540dadc539cc14ae65dd
-
SHA512
0bba9533f7b47363ea6261b9f4846d95cc8401c0972ed53861a27da3eec0a703817b621e62fe2aaef6317be30e5e030d5087d9fe8d563ac3fd4a160ef92960bb
-
SSDEEP
6144:HXidJ8nXuvtsOG133fi7XGwMOi5669XVYpZ5UmnIkVIODrXStLaONQk2:HXK8pOG133q7XGwHO66xVAIokLnQr
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63b36771a117aef79e1fad77a6e300fe_JaffaCakes118
Files
-
63b36771a117aef79e1fad77a6e300fe_JaffaCakes118.dll windows:5 windows x86 arch:x86
08a1ea7dd87a4148750d2fe95a6f4d2c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlOemStringToUnicodeString
MmResetDriverPaging
RtlUnicodeStringToAnsiString
KeQuerySystemTime
ZwOpenSection
IoInvalidateDeviceRelations
PsDereferencePrimaryToken
IoGetRequestorProcessId
RtlGetNextRange
KeSetTargetProcessorDpc
MmMapLockedPagesSpecifyCache
IoGetBootDiskInformation
MmForceSectionClosed
KeInsertByKeyDeviceQueue
IoReuseIrp
PoStartNextPowerIrp
ZwCreateKey
FsRtlLookupLastLargeMcbEntry
FsRtlGetNextFileLock
RtlFindLongestRunClear
ExRaiseAccessViolation
KeSetImportanceDpc
FsRtlFastCheckLockForRead
RtlAnsiStringToUnicodeString
PsLookupThreadByThreadId
IoCreateNotificationEvent
RtlInitString
IoFreeMdl
ObCreateObject
IoCreateDevice
RtlEqualString
IoIsSystemThread
ZwClose
ExVerifySuite
ObQueryNameString
IoGetDriverObjectExtension
MmGetPhysicalAddress
SeOpenObjectAuditAlarm
CcRemapBcb
RtlInt64ToUnicodeString
RtlLengthRequiredSid
MmAllocateNonCachedMemory
ExRegisterCallback
RtlCompareMemory
IoGetCurrentProcess
RtlLengthSecurityDescriptor
RtlAppendUnicodeToString
IoAcquireCancelSpinLock
RtlUpperString
RtlInitializeBitMap
IoOpenDeviceRegistryKey
KeStackAttachProcess
IoSetSystemPartition
PsSetLoadImageNotifyRoutine
IoGetDeviceInterfaceAlias
ExNotifyCallback
MmUnsecureVirtualMemory
IoGetStackLimits
IoStopTimer
IoInitializeTimer
MmProbeAndLockPages
MmUnmapLockedPages
RtlInitializeSid
RtlUpcaseUnicodeToOemN
RtlDowncaseUnicodeString
FsRtlNotifyInitializeSync
RtlDeleteNoSplay
MmLockPagableSectionByHandle
RtlAppendStringToString
ZwCreateDirectoryObject
IoStartNextPacket
MmMapIoSpace
PsGetCurrentProcess
RtlStringFromGUID
MmIsAddressValid
ExAllocatePoolWithQuotaTag
MmSetAddressRangeModified
IoSetThreadHardErrorMode
ZwCreateSection
RtlTimeToSecondsSince1980
IoReportResourceForDetection
IoWMIRegistrationControl
FsRtlSplitLargeMcb
IoCreateSynchronizationEvent
IoAllocateMdl
ExReinitializeResourceLite
SeQueryAuthenticationIdToken
KeGetCurrentThread
RtlCopyLuid
ZwEnumerateKey
ObGetObjectSecurity
RtlAnsiCharToUnicodeChar
KeInitializeSpinLock
ZwOpenFile
PsGetVersion
MmQuerySystemSize
DbgBreakPointWithStatus
KeReleaseMutex
IoDeviceObjectType
KdDisableDebugger
ExSystemTimeToLocalTime
MmLockPagableDataSection
PoSetSystemState
IoConnectInterrupt
IoStartPacket
KeReadStateEvent
ZwOpenKey
IoMakeAssociatedIrp
RtlCharToInteger
ZwDeleteKey
ExInitializeResourceLite
ZwQueryVolumeInformationFile
KeQueryTimeIncrement
MmAllocateContiguousMemory
ExDeletePagedLookasideList
MmPageEntireDriver
RtlValidSecurityDescriptor
RtlAreBitsClear
RtlUpcaseUnicodeString
RtlUpperChar
ExUuidCreate
KeLeaveCriticalRegion
FsRtlAllocateFileLock
RtlFindLeastSignificantBit
IoStartTimer
IoAllocateWorkItem
RtlTimeFieldsToTime
SeTokenIsRestricted
RtlInitializeUnicodePrefix
KeInitializeQueue
FsRtlCheckOplock
ExReleaseResourceLite
IoGetDeviceInterfaces
SeDeassignSecurity
ExGetPreviousMode
ProbeForWrite
ZwEnumerateValueKey
RtlCheckRegistryKey
ExDeleteResourceLite
IoRemoveShareAccess
RtlCopyUnicodeString
IoGetAttachedDevice
MmIsDriverVerifying
RtlRandom
KdEnableDebugger
IoFreeController
SeTokenIsAdmin
FsRtlIsNameInExpression
KeRegisterBugCheckCallback
KeInitializeTimerEx
RtlSecondsSince1980ToTime
ZwMapViewOfSection
RtlFindMostSignificantBit
KeRemoveQueueDpc
MmSecureVirtualMemory
RtlFindNextForwardRunClear
RtlPrefixUnicodeString
ExGetSharedWaiterCount
RtlxAnsiStringToUnicodeSize
RtlUnicodeStringToInteger
ExDeleteNPagedLookasideList
RtlFindSetBits
KeInitializeApc
RtlEnumerateGenericTable
RtlCreateUnicodeString
SeDeleteObjectAuditAlarm
RtlUnicodeToMultiByteN
FsRtlIsDbcsInExpression
RtlFindClearBits
SeCreateClientSecurity
KeQueryActiveProcessors
IoWriteErrorLogEntry
MmUnmapIoSpace
KePulseEvent
IoDeleteDevice
IoCheckEaBufferValidity
CcUnpinDataForThread
ObReferenceObjectByHandle
RtlCreateSecurityDescriptor
CcCopyRead
MmFreePagesFromMdl
IoReleaseCancelSpinLock
RtlNtStatusToDosError
SeImpersonateClientEx
RtlTimeToTimeFields
RtlCopyString
RtlUnicodeToOemN
ExSetResourceOwnerPointer
KeCancelTimer
CcFastCopyWrite
RtlGetVersion
RtlValidSid
FsRtlCheckLockForWriteAccess
KeInitializeEvent
IoBuildSynchronousFsdRequest
ZwMakeTemporaryObject
KeInsertHeadQueue
PsCreateSystemThread
ZwFlushKey
KeRemoveQueue
KeSetTimerEx
RtlSecondsSince1970ToTime
KeBugCheckEx
KeReleaseSemaphore
KeRemoveEntryDeviceQueue
RtlRemoveUnicodePrefix
PoRequestPowerIrp
MmSizeOfMdl
RtlInitAnsiString
ZwReadFile
IoAllocateIrp
ExIsProcessorFeaturePresent
RtlCompareUnicodeString
RtlHashUnicodeString
IoSetShareAccess
PsGetCurrentThread
IoAttachDeviceToDeviceStack
RtlFreeAnsiString
KeDeregisterBugCheckCallback
RtlUpcaseUnicodeChar
RtlMapGenericMask
CcFastCopyRead
IoFreeWorkItem
PsIsThreadTerminating
ExAcquireFastMutexUnsafe
RtlSubAuthoritySid
FsRtlIsTotalDeviceFailure
ExLocalTimeToSystemTime
KeInitializeTimer
IoCancelIrp
CcSetBcbOwnerPointer
CcPreparePinWrite
RtlFindClearRuns
RtlCreateRegistryKey
IoGetRelatedDeviceObject
IoInitializeIrp
IoCheckQuotaBufferValidity
KeSetTimer
RtlSetAllBits
IoGetAttachedDeviceReference
MmFreeContiguousMemory
FsRtlFastUnlockSingle
RtlSetDaclSecurityDescriptor
CcDeferWrite
FsRtlFreeFileLock
PsLookupProcessByProcessId
ProbeForRead
IoCreateFile
RtlFindClearBitsAndSet
RtlMultiByteToUnicodeN
RtlDeleteRegistryValue
RtlCopySid
KeReadStateMutex
Sections
.text Size: 34KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 459B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ