N:\iwigwuu\dotfEjhL\yvqyTImnjL\hvrkLdlajm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6aafd38ecb0a192f683b3e76e9722f82_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6aafd38ecb0a192f683b3e76e9722f82_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6aafd38ecb0a192f683b3e76e9722f82_JaffaCakes118
-
Size
180KB
-
MD5
6aafd38ecb0a192f683b3e76e9722f82
-
SHA1
cbde6b5d4bfe7ba660d18b134bc44d840e890ba0
-
SHA256
20ab9e69175ad82c0dfcc954a1c065dfa502de754e16cee69f1980209047ba81
-
SHA512
c7562d1a437ebcfa89812f25555a9bdf62c84d645c3a83a0aad7f047984ba213540adb1aa1140c95e8ee49623f65683c04dbbeddbf4b33533d6fbf77b3efd6b0
-
SSDEEP
3072:v51aKM3hc8C3bT7wN6nwBMUfgnZEeZPn0thbeeFPoYGBOdX:/gcZ7eqZEEPSBjLc2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6aafd38ecb0a192f683b3e76e9722f82_JaffaCakes118
Files
-
6aafd38ecb0a192f683b3e76e9722f82_JaffaCakes118.dll windows:5 windows x86 arch:x86
1877eac40d28b58687d7ce950e8a7a8a
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ExSystemTimeToLocalTime
DbgBreakPointWithStatus
KeRemoveEntryDeviceQueue
ZwDeviceIoControlFile
IoCreateStreamFileObjectLite
KeEnterCriticalRegion
RtlFreeUnicodeString
RtlEqualUnicodeString
IoInvalidateDeviceRelations
ExFreePool
IoCreateNotificationEvent
RtlSubAuthoritySid
MmAllocatePagesForMdl
FsRtlDeregisterUncProvider
ExDeleteResourceLite
RtlStringFromGUID
RtlDelete
KeReadStateMutex
PoCallDriver
ExNotifyCallback
RtlInitString
PsSetLoadImageNotifyRoutine
RtlAnsiCharToUnicodeChar
IoGetDiskDeviceObject
ZwFsControlFile
MmProbeAndLockPages
KeInitializeDeviceQueue
PsDereferencePrimaryToken
KeReadStateTimer
KeReadStateSemaphore
HalExamineMBR
KeInitializeDpc
KdEnableDebugger
RtlFindClearBitsAndSet
RtlGetVersion
CcPinMappedData
IoDetachDevice
RtlFindMostSignificantBit
MmUnmapLockedPages
MmResetDriverPaging
PsImpersonateClient
DbgBreakPoint
MmFreePagesFromMdl
RtlUnicodeStringToOemString
KeInitializeSemaphore
MmPageEntireDriver
ObfDereferenceObject
ZwCreateFile
ZwOpenProcess
ExVerifySuite
SeAppendPrivileges
ObReferenceObjectByPointer
MmIsThisAnNtAsSystem
IoReadDiskSignature
RtlTimeToTimeFields
PsLookupThreadByThreadId
SeCaptureSubjectContext
IoGetRequestorProcessId
IoReportResourceForDetection
ProbeForRead
ExInitializeResourceLite
ZwNotifyChangeKey
SeQueryInformationToken
KeRestoreFloatingPointState
ZwClose
CcIsThereDirtyData
SeAssignSecurity
IoGetDeviceInterfaceAlias
ZwFreeVirtualMemory
CcMapData
IoReadPartitionTableEx
SeCreateClientSecurity
SeUnlockSubjectContext
RtlDowncaseUnicodeString
IoIsOperationSynchronous
ExAcquireFastMutexUnsafe
RtlIsNameLegalDOS8Dot3
FsRtlCheckOplock
SeDeassignSecurity
IoDeleteSymbolicLink
IoGetDeviceInterfaces
IoConnectInterrupt
IoOpenDeviceRegistryKey
CcUnpinDataForThread
MmForceSectionClosed
CcMdlReadComplete
PsChargeProcessPoolQuota
FsRtlFastUnlockSingle
RtlSetAllBits
ExQueueWorkItem
KeInitializeMutex
RtlLengthRequiredSid
IoDeviceObjectType
SeSinglePrivilegeCheck
KeFlushQueuedDpcs
MmFreeNonCachedMemory
FsRtlCheckLockForWriteAccess
MmFreeMappingAddress
KeInitializeQueue
IoInvalidateDeviceState
RtlOemStringToUnicodeString
MmHighestUserAddress
MmIsVerifierEnabled
CcCopyWrite
IoWMIRegistrationControl
RtlSecondsSince1980ToTime
MmUnmapIoSpace
ExRaiseDatatypeMisalignment
ObQueryNameString
RtlSetDaclSecurityDescriptor
IoWritePartitionTableEx
PoSetSystemState
RtlUpcaseUnicodeToOemN
ExRegisterCallback
MmGetPhysicalAddress
IoVerifyPartitionTable
CcSetDirtyPinnedData
RtlValidSid
RtlVolumeDeviceToDosName
IoReleaseCancelSpinLock
IoCreateDisk
CcFlushCache
ExLocalTimeToSystemTime
CcSetReadAheadGranularity
KeBugCheck
ProbeForWrite
KeReleaseSemaphore
RtlAreBitsClear
ZwQueryValueKey
RtlGenerate8dot3Name
SeQueryAuthenticationIdToken
RtlEqualSid
ZwUnloadDriver
IoIsWdmVersionAvailable
ExFreePoolWithTag
IoCheckQuotaBufferValidity
RtlDeleteElementGenericTable
RtlCreateUnicodeString
CcSetBcbOwnerPointer
RtlTimeFieldsToTime
IoDisconnectInterrupt
ExReleaseFastMutexUnsafe
FsRtlSplitLargeMcb
IoGetDriverObjectExtension
IoGetRelatedDeviceObject
DbgPrompt
RtlCompareString
KeSetPriorityThread
MmCanFileBeTruncated
RtlClearBits
KeDetachProcess
IoAllocateAdapterChannel
ZwEnumerateValueKey
IoGetStackLimits
MmIsAddressValid
RtlUnicodeToMultiByteN
ZwQueryVolumeInformationFile
RtlDeleteNoSplay
IoStartTimer
IoCheckShareAccess
MmQuerySystemSize
CcMdlRead
RtlMultiByteToUnicodeN
IoFreeController
KeUnstackDetachProcess
ObGetObjectSecurity
FsRtlIsTotalDeviceFailure
ZwFlushKey
KeAttachProcess
KeSetTimer
MmAdvanceMdl
RtlAddAccessAllowedAce
KeSetKernelStackSwapEnable
KeQuerySystemTime
MmAllocateMappingAddress
IoSetTopLevelIrp
CcRemapBcb
MmSetAddressRangeModified
ExGetSharedWaiterCount
IoStartPacket
KeSetSystemAffinityThread
IoThreadToProcess
ExSetResourceOwnerPointer
RtlQueryRegistryValues
RtlInitializeUnicodePrefix
RtlFindUnicodePrefix
RtlNumberOfClearBits
ZwQueryKey
IoUpdateShareAccess
RtlClearAllBits
IoFreeWorkItem
PsReturnPoolQuota
RtlTimeToSecondsSince1970
ExSetTimerResolution
KeInitializeApc
FsRtlIsFatDbcsLegal
ExUuidCreate
ZwSetValueKey
PsGetCurrentThread
RtlFindLeastSignificantBit
RtlInitAnsiString
SeFilterToken
PsGetCurrentProcess
SeTokenIsAdmin
IoCsqRemoveIrp
RtlCompareMemory
PoSetPowerState
FsRtlIsHpfsDbcsLegal
CcFastCopyRead
IoSetDeviceInterfaceState
IoFreeErrorLogEntry
PsGetVersion
IoGetDeviceProperty
ZwSetVolumeInformationFile
RtlxUnicodeStringToAnsiSize
CcGetFileObjectFromBcb
MmSizeOfMdl
IoCreateSymbolicLink
IoAllocateWorkItem
RtlCreateAcl
PoRegisterSystemState
RtlNtStatusToDosError
IoStopTimer
MmMapLockedPagesSpecifyCache
SeValidSecurityDescriptor
IoAcquireCancelSpinLock
RtlAnsiStringToUnicodeString
IoGetDeviceToVerify
MmAllocateNonCachedMemory
RtlInitializeSid
IoRaiseHardError
RtlVerifyVersionInfo
CcPreparePinWrite
KeSetBasePriorityThread
IoGetDeviceAttachmentBaseRef
IoVolumeDeviceToDosName
ZwCreateDirectoryObject
FsRtlGetNextFileLock
RtlCopyString
IoSetThreadHardErrorMode
CcUnpinData
KeWaitForSingleObject
ZwSetSecurityObject
RtlCopySid
KeDeregisterBugCheckCallback
ZwOpenSection
MmMapUserAddressesToPage
RtlFindLongestRunClear
RtlCharToInteger
ZwCreateKey
KeQueryInterruptTime
MmUnlockPages
ZwDeleteKey
MmFlushImageSection
FsRtlNotifyUninitializeSync
RtlFindLastBackwardRunClear
RtlUpcaseUnicodeString
ZwMapViewOfSection
Exports
Exports
?ValidateProcessOld@@YGXJGK&U
?ScreenNew@@YGPAEHI&U
?EnumTextEx@@YGPAKG&U
?CancelSectionA@@YGJPAM&U
?HideArgumentA@@YGEPAGPAD&U
?RemoveEventExW@@YGFDJM&U
?CopyFolderNew@@YGJPAK_NPAG_N&U
?ValidateMutexExA@@YGPAFPAG&U
?ModifyMessageEx@@YGPAGGPA_N&U
?GlobalExpressionExW@@YGNKEPAH&U
?GenerateValue@@YGXI&U
?DecrementWindow@@YGPAMEGF&U
?ShowFullNameEx@@YGKF&U
?ShowFolderW@@YGIKPAG&U
?CrtHeightW@@YGJD_NJ&U
?ValidateWidthExW@@YGHEG&U
?GenerateSectionOld@@YGFDFPAE&U
?ModifyPenA@@YGXPAI&U
?CallTimeOld@@YGXGJ&U
?GetDateTimeNew@@YGHFK&U
?GenerateValueOriginal@@YGDJH&U
?FindStringExA@@YGPAHN&U
?InsertFolderPathA@@YGPAXHPAEPAN&U
?FreeKeyName@@YGG_ND&U
?FindPointerW@@YGG_NKD&U
?IsValidDeviceExW@@YGMDEKI&U
?GlobalDirectoryA@@YGGPAJPAMKK&U
?FreeObjectExA@@YGPAJH&U
?IsKeyNameW@@YGGF&U
?CallMediaTypeA@@YGJPAMH_NI&U
?DecrementComponentExA@@YGPAIPAE&U
?LoadComponentExA@@YGXPAK&U
Sections
.text Size: 28KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 742B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ