p:\sz\x64\release\InCSRSS.pdb
Static task
static1
Behavioral task
behavioral1
Sample
63e99b675a1337db6d8430195ea3efd2_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
63e99b675a1337db6d8430195ea3efd2_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
63e99b675a1337db6d8430195ea3efd2_JaffaCakes118
-
Size
53KB
-
MD5
63e99b675a1337db6d8430195ea3efd2
-
SHA1
1baead2bf8f433dc82f9b2c03fd65ce697a92155
-
SHA256
6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9
-
SHA512
f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f
-
SSDEEP
768:CCM3+iE5d5KdwhXecT/obNzsyl1FHFftFeorFScPk6N147ZUwim:CCmNvdw3g5FfV147SBm
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 63e99b675a1337db6d8430195ea3efd2_JaffaCakes118
Files
-
63e99b675a1337db6d8430195ea3efd2_JaffaCakes118.dll windows:5 windows x64 arch:x64
cdfd5d2c7f6be83b62c92e19d5db900f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
ZwWriteFile
ZwCreateSection
ZwDeleteFile
ZwOpenFile
ZwDeviceIoControlFile
strcpy
ZwMakeTemporaryObject
RtlInitUnicodeString
swprintf
LdrFindEntryForAddress
ZwQueueApcThread
ZwWriteVirtualMemory
ZwAllocateVirtualMemory
ZwQueryInformationThread
ZwOpenThread
ZwOpenProcess
ZwQuerySystemInformation
RtlEqualUnicodeString
ZwReadVirtualMemory
ZwQueryInformationProcess
LdrProcessRelocationBlock
RtlImageDirectoryEntryToData
RtlImageNtHeader
ZwAlertThread
ZwWaitForSingleObject
RtlCreateUserThread
RtlComputeCrc32
ZwAllocateLocallyUniqueId
ZwDelayExecution
ZwCreateEvent
ZwAdjustPrivilegesToken
ZwOpenProcessToken
ZwNotifyChangeKey
ZwSetInformationObject
ZwSetValueKey
memcmp
wcsstr
ZwFsControlFile
wcslen
ZwCreateFile
memset
ZwClose
ZwOpenKey
ZwQueryValueKey
memcpy
RtlExitUserThread
ZwCreateSymbolicLinkObject
LdrUnloadDll
__chkstk
kernel32
Sleep
DisableThreadLibraryCalls
CreateThread
LoadLibraryA
VirtualAlloc
SwitchToThread
GetTickCount
LoadLibraryW
VirtualFree
GetProcAddress
SleepEx
advapi32
CloseServiceHandle
OpenServiceW
ControlService
OpenSCManagerW
ws2_32
WSAStartup
WSACleanup
Exports
Exports
ConServerDllInitialization
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 994B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 216B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 288B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ