Y:\BXgmlZm\otrUrsLQt\wldhfTuihPg\fMslbgfK\fxqengyZwDr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6757276f62626d7cea7e23af3692f1fc_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6757276f62626d7cea7e23af3692f1fc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6757276f62626d7cea7e23af3692f1fc_JaffaCakes118
-
Size
135KB
-
MD5
6757276f62626d7cea7e23af3692f1fc
-
SHA1
feaa42d65b01aaf1323ef80f696ab87a3acbeaf9
-
SHA256
4cdc954c31d3e00956aea5db4cde448822a5bea87e0a816f4e625ccab957f871
-
SHA512
0e13d4d94ccc48c81e666fc2427516fd1b842f4444da79fbb156fd079b9ca7b7e91f4ee5a81959ac0e0afea38487b3784da6d611c2fe28f7b6d4275340dbe498
-
SSDEEP
3072:nmXlMuBDIsWU7ZEAi0Gv7YHZE76VuLFUSfSEp:mdksWU7Zpi5YHaVLa7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6757276f62626d7cea7e23af3692f1fc_JaffaCakes118
Files
-
6757276f62626d7cea7e23af3692f1fc_JaffaCakes118.dll windows:5 windows x86 arch:x86
c9b6253e404e7a27bec50ef1c03c325d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlEqualUnicodeString
RtlCreateUnicodeString
RtlLengthSecurityDescriptor
RtlInitString
KeRemoveEntryDeviceQueue
KeReadStateMutex
KeInitializeQueue
RtlCompareString
RtlEqualString
MmGetSystemRoutineAddress
ZwFsControlFile
RtlUpperChar
IoGetAttachedDevice
RtlInitializeGenericTable
RtlIntegerToUnicodeString
SeSinglePrivilegeCheck
RtlInitUnicodeString
PoStartNextPowerIrp
strcat
IoCheckEaBufferValidity
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 1024B - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 840B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ