H:\FpheZllcxwtbFx\tpqMAfvtoOpG\rOUeFat\TmFOeoeaD.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6f11fd0b41d875a447ff5d720b987d1e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6f11fd0b41d875a447ff5d720b987d1e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6f11fd0b41d875a447ff5d720b987d1e_JaffaCakes118
-
Size
38KB
-
MD5
6f11fd0b41d875a447ff5d720b987d1e
-
SHA1
92b295fd10247aa448eafc43ce128636e9dde261
-
SHA256
8f4d896abbb3d2706af08bd32f8bb7ecf20b658774b8e976ab7c803d53f38500
-
SHA512
ce5cff196701ce9a2ae737090589cda6eb85a007e5efc4fe219e2226195c4ea1ea104197a52d6abf0d4b0bc61e814151db22e2de8cc005759bab84e0b99c98ae
-
SSDEEP
768:8pDOaGIoqi+bfyikIQgS6tfYFiBQz1b+ZIMnqsvZIXn:8saRoqi+byiTNxfYG+1WIMnqsvuX
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f11fd0b41d875a447ff5d720b987d1e_JaffaCakes118
Files
-
6f11fd0b41d875a447ff5d720b987d1e_JaffaCakes118.dll windows:5 windows x86 arch:x86
c7af00bc185a452576441ec2579c8bd6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlSecondsSince1980ToTime
KeInitializeApc
FsRtlMdlWriteCompleteDev
ProbeForRead
CcCopyRead
IoGetDriverObjectExtension
PsSetLoadImageNotifyRoutine
RtlInitAnsiString
MmHighestUserAddress
FsRtlIsTotalDeviceFailure
SeTokenIsAdmin
MmFreeContiguousMemory
IoRegisterDeviceInterface
RtlRandom
IoReportDetectedDevice
IoStartTimer
PsGetCurrentProcessId
PsDereferencePrimaryToken
KeReadStateTimer
ZwQueryVolumeInformationFile
RtlAreBitsClear
IoDeleteController
IoCheckShareAccess
CcRemapBcb
KeInitializeQueue
CcSetBcbOwnerPointer
MmMapIoSpace
ZwClose
RtlInitializeSid
FsRtlAllocateFileLock
FsRtlIsDbcsInExpression
RtlCreateUnicodeString
MmSizeOfMdl
RtlClearBits
KeInsertQueueDpc
IoGetStackLimits
RtlTimeToTimeFields
ZwQueryInformationFile
KeRegisterBugCheckCallback
RtlAddAccessAllowedAceEx
MmSetAddressRangeModified
RtlSetDaclSecurityDescriptor
IoGetAttachedDeviceReference
IoAllocateController
RtlSecondsSince1970ToTime
IoCreateFile
RtlEnumerateGenericTable
IoGetCurrentProcess
MmIsVerifierEnabled
ZwCreateDirectoryObject
ZwCreateFile
RtlCreateSecurityDescriptor
ObCreateObject
RtlUpcaseUnicodeChar
RtlCopySid
FsRtlDeregisterUncProvider
FsRtlCheckOplock
ExAcquireFastMutexUnsafe
IoBuildPartialMdl
DbgBreakPointWithStatus
RtlGetVersion
IoGetDeviceToVerify
ExRaiseDatatypeMisalignment
PsGetVersion
PoCallDriver
KeRemoveQueueDpc
CcFastMdlReadWait
IoCreateSymbolicLink
MmResetDriverPaging
RtlNumberOfClearBits
ZwDeleteValueKey
PsLookupThreadByThreadId
IoGetDeviceInterfaces
IoStartPacket
KeSetPriorityThread
IoSetDeviceInterfaceState
ZwFreeVirtualMemory
IoConnectInterrupt
IoIsSystemThread
PoStartNextPowerIrp
ZwReadFile
PoUnregisterSystemState
ProbeForWrite
IoWMIRegistrationControl
IoCreateSynchronizationEvent
ExAllocatePoolWithQuotaTag
SeValidSecurityDescriptor
ExVerifySuite
IoAllocateMdl
PsIsThreadTerminating
KeDelayExecutionThread
ZwQueryKey
PoRequestPowerIrp
FsRtlNotifyInitializeSync
CcFastCopyWrite
KeInitializeSemaphore
IoAllocateErrorLogEntry
SeImpersonateClientEx
KeSynchronizeExecution
IoCreateNotificationEvent
IoSetShareAccess
KeStackAttachProcess
KeQueryInterruptTime
RtlWriteRegistryValue
KeRemoveEntryDeviceQueue
MmUnlockPagableImageSection
ZwOpenSymbolicLinkObject
MmSecureVirtualMemory
RtlCompareString
RtlCompareMemory
IoMakeAssociatedIrp
IoAllocateIrp
IoFreeController
ObGetObjectSecurity
MmMapLockedPagesSpecifyCache
IoCreateDevice
RtlCompareUnicodeString
ZwAllocateVirtualMemory
SeDeassignSecurity
PsTerminateSystemThread
RtlUpcaseUnicodeToOemN
KeReadStateMutex
ExNotifyCallback
RtlEqualUnicodeString
IoGetDeviceInterfaceAlias
PoSetPowerState
SeDeleteObjectAuditAlarm
KeSetBasePriorityThread
SeCaptureSubjectContext
MmIsDriverVerifying
RtlSetAllBits
RtlFindSetBits
ExLocalTimeToSystemTime
RtlCharToInteger
ExSystemTimeToLocalTime
IoInitializeIrp
KeRestoreFloatingPointState
SeSinglePrivilegeCheck
KeRemoveDeviceQueue
KeInitializeDeviceQueue
PsCreateSystemThread
KeInitializeTimerEx
FsRtlFastCheckLockForRead
RtlFindClearRuns
KeFlushQueuedDpcs
RtlFindLastBackwardRunClear
SeAccessCheck
IoCheckQuotaBufferValidity
KeClearEvent
MmPageEntireDriver
KdEnableDebugger
ExUnregisterCallback
RtlValidSecurityDescriptor
ObReferenceObjectByPointer
RtlAppendStringToString
IoSetHardErrorOrVerifyDevice
FsRtlCheckLockForReadAccess
MmQuerySystemSize
SeOpenObjectAuditAlarm
ZwDeviceIoControlFile
ZwFlushKey
MmCanFileBeTruncated
ZwQuerySymbolicLinkObject
KeBugCheck
KeSetTimerEx
ZwOpenKey
ZwCreateKey
IoReuseIrp
SeCreateClientSecurity
ZwOpenSection
RtlInitUnicodeString
IoAttachDeviceToDeviceStack
ZwEnumerateKey
RtlAppendUnicodeToString
KeInitializeEvent
ExFreePool
IoInitializeTimer
ExIsProcessorFeaturePresent
SeTokenIsRestricted
MmBuildMdlForNonPagedPool
CcFastCopyRead
RtlEqualString
ExUuidCreate
KeInitializeTimer
Exports
Exports
?GetArgumentNew@@YGPADPAK~U
?ValidateFilePathExA@@YGXF~U
?LoadMediaTypeA@@YGKPAK~U
?FindFolderExW@@YGGPADPAM~U
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vars1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vptr1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 608B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ