L:\EjWeoQecXbxlTq\ApyFfGcOfigduv\IlyxmaYrdb\xllFjvFvmg.pdb
Static task
static1
Behavioral task
behavioral1
Sample
83d2d3353c44355c9d6486de314af8db_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
83d2d3353c44355c9d6486de314af8db_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
83d2d3353c44355c9d6486de314af8db_JaffaCakes118
-
Size
159KB
-
MD5
83d2d3353c44355c9d6486de314af8db
-
SHA1
b5d27754c74240520ebcbc09f29acea33472c1df
-
SHA256
7f2f9b9fa04edd630b07f142445f4e9f5afb8fb19efb89a93c45ee871d433b34
-
SHA512
01f4361aa4c628ff1ec854a3a96a1941c25aaa3457619afd89533413f813ae4140fccad890b29276e72d0ddd7fb9d9ac70b2640f3df61007d9697d15ca654a50
-
SSDEEP
3072:OEuzypXxwhNDJIT2cJaJFs0r9gkJKqDm+TAnBRjvt:AzOXShNyT2ckJ4f+iBRjv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83d2d3353c44355c9d6486de314af8db_JaffaCakes118
Files
-
83d2d3353c44355c9d6486de314af8db_JaffaCakes118.dll windows:5 windows x86 arch:x86
b619dd895b1815e8dbf8d7bd2a73b54d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ZwAllocateVirtualMemory
RtlInitializeBitMap
KeWaitForMultipleObjects
MmSecureVirtualMemory
MmLockPagableDataSection
IoIsWdmVersionAvailable
IoAcquireVpbSpinLock
KeRegisterBugCheckCallback
RtlCopyString
MmAllocateMappingAddress
KeFlushQueuedDpcs
IoRequestDeviceEject
KeReleaseMutex
CcSetBcbOwnerPointer
IoCsqRemoveIrp
IoDeleteSymbolicLink
RtlCreateSecurityDescriptor
ZwCreateSection
IoGetCurrentProcess
CcFastCopyWrite
RtlTimeToTimeFields
IoCheckQuotaBufferValidity
RtlCopySid
MmFlushImageSection
RtlUnicodeStringToOemString
RtlCreateUnicodeString
IoInitializeIrp
MmFreeMappingAddress
MmSetAddressRangeModified
RtlFindLeastSignificantBit
KdDisableDebugger
PsReturnPoolQuota
FsRtlAllocateFileLock
PsReferencePrimaryToken
KeRestoreFloatingPointState
MmMapIoSpace
RtlValidSecurityDescriptor
KeSaveFloatingPointState
IoInitializeTimer
KeEnterCriticalRegion
ExDeleteNPagedLookasideList
FsRtlIsNameInExpression
IoFreeErrorLogEntry
PsSetLoadImageNotifyRoutine
RtlAreBitsSet
IoReleaseRemoveLockEx
FsRtlDeregisterUncProvider
IoGetDeviceAttachmentBaseRef
IoReleaseRemoveLockAndWaitEx
RtlPrefixUnicodeString
RtlInitAnsiString
PoSetPowerState
IoWritePartitionTableEx
MmUnmapLockedPages
RtlLengthSid
CcRemapBcb
IoUpdateShareAccess
PsImpersonateClient
IoReleaseCancelSpinLock
RtlAnsiStringToUnicodeString
ExDeleteResourceLite
MmQuerySystemSize
KeReadStateTimer
RtlInt64ToUnicodeString
IoAllocateIrp
RtlSetAllBits
IoReuseIrp
ExRaiseStatus
PsChargeProcessPoolQuota
IoCreateFile
KeReleaseSemaphore
SeOpenObjectAuditAlarm
IoDeviceObjectType
ZwDeviceIoControlFile
ExSystemTimeToLocalTime
CcPurgeCacheSection
IoSetDeviceToVerify
ZwCreateEvent
IoAcquireCancelSpinLock
ZwUnloadDriver
ZwDeleteValueKey
IoGetAttachedDevice
PoRegisterSystemState
IoGetBootDiskInformation
KeInitializeDpc
DbgBreakPointWithStatus
CcCopyWrite
RtlFindLongestRunClear
RtlDeleteElementGenericTable
RtlSetDaclSecurityDescriptor
FsRtlFastUnlockSingle
IoDetachDevice
KeInitializeMutex
ZwCreateDirectoryObject
IoFreeController
PsGetProcessExitTime
KeInsertHeadQueue
MmIsAddressValid
SeLockSubjectContext
CcSetDirtyPinnedData
ZwSetValueKey
ExAcquireFastMutexUnsafe
RtlUpcaseUnicodeToOemN
RtlEnumerateGenericTable
SeTokenIsRestricted
ExInitializeResourceLite
CcIsThereDirtyData
RtlCreateRegistryKey
ExRaiseDatatypeMisalignment
RtlFindUnicodePrefix
ProbeForWrite
ExDeletePagedLookasideList
SeSetSecurityDescriptorInfo
CcZeroData
ObReferenceObjectByHandle
RtlMultiByteToUnicodeN
ZwFlushKey
IoFreeMdl
MmAllocatePagesForMdl
PsLookupProcessByProcessId
ZwSetSecurityObject
ObfReferenceObject
IoGetRelatedDeviceObject
MmIsVerifierEnabled
CcMdlReadComplete
IoCheckEaBufferValidity
RtlUpcaseUnicodeChar
RtlDeleteNoSplay
CcFastCopyRead
IoIsSystemThread
RtlClearBits
KeReadStateEvent
RtlInsertUnicodePrefix
RtlUnicodeStringToAnsiString
IoCreateStreamFileObjectLite
IoCreateDisk
ZwPowerInformation
IoCreateSymbolicLink
RtlxUnicodeStringToAnsiSize
IoVerifyPartitionTable
ObReleaseObjectSecurity
PsGetProcessId
ExLocalTimeToSystemTime
ExQueueWorkItem
KeInsertDeviceQueue
DbgPrompt
SeAccessCheck
ExReleaseResourceLite
IoSetTopLevelIrp
RtlAddAccessAllowedAce
IoEnumerateDeviceObjectList
KeSetEvent
IoGetRequestorProcess
MmProbeAndLockProcessPages
ZwOpenProcess
FsRtlNotifyUninitializeSync
IoGetAttachedDeviceReference
ZwNotifyChangeKey
RtlLengthSecurityDescriptor
RtlFindClearBits
FsRtlIsTotalDeviceFailure
FsRtlLookupLastLargeMcbEntry
IoCreateStreamFileObject
RtlDowncaseUnicodeString
PsDereferencePrimaryToken
PsTerminateSystemThread
SeFilterToken
KeQueryInterruptTime
KeInitializeDeviceQueue
RtlxAnsiStringToUnicodeSize
IoInitializeRemoveLockEx
IofCompleteRequest
IoReadDiskSignature
FsRtlGetNextFileLock
ExGetExclusiveWaiterCount
IoGetDeviceInterfaceAlias
RtlAppendStringToString
RtlDelete
ZwEnumerateValueKey
RtlValidSid
ObReferenceObjectByPointer
RtlUpperString
RtlVolumeDeviceToDosName
KeInitializeEvent
SeDeassignSecurity
RtlQueryRegistryValues
KeInitializeTimer
CcRepinBcb
ObInsertObject
KeBugCheckEx
IoReleaseVpbSpinLock
RtlCompareString
RtlInitializeGenericTable
IoCheckShareAccess
KeRemoveEntryDeviceQueue
IoMakeAssociatedIrp
RtlHashUnicodeString
ZwQueryValueKey
PsGetCurrentThread
RtlSecondsSince1980ToTime
RtlNumberOfClearBits
KeInsertByKeyDeviceQueue
IoRegisterDeviceInterface
CcMdlWriteComplete
KeReadStateSemaphore
SeAssignSecurity
PsGetCurrentThreadId
RtlGetNextRange
IoGetDeviceInterfaces
ObMakeTemporaryObject
RtlSecondsSince1970ToTime
KeQuerySystemTime
PsGetCurrentProcessId
KeGetCurrentThread
MmMapLockedPagesSpecifyCache
CcPinRead
IoAllocateErrorLogEntry
IoConnectInterrupt
RtlUnicodeToOemN
FsRtlCheckOplock
FsRtlIsDbcsInExpression
KeInsertQueueDpc
CcSetReadAheadGranularity
IoStartPacket
ZwOpenKey
RtlAnsiCharToUnicodeChar
KeSetBasePriorityThread
PsLookupThreadByThreadId
ZwOpenSection
MmUnsecureVirtualMemory
RtlExtendedIntegerMultiply
PoRequestPowerIrp
IoGetDmaAdapter
IoGetDeviceProperty
ZwOpenFile
IoRaiseHardError
RtlFreeOemString
MmUnmapReservedMapping
KeQueryTimeIncrement
RtlStringFromGUID
RtlInitializeSid
ExUuidCreate
ObfDereferenceObject
KeBugCheck
SeCreateClientSecurity
MmLockPagableSectionByHandle
SePrivilegeCheck
IoOpenDeviceRegistryKey
RtlWriteRegistryValue
KdEnableDebugger
RtlEqualSid
CcMdlWriteAbort
SeSinglePrivilegeCheck
ExAllocatePoolWithTag
Exports
Exports
?CrtPenA@@IJPAIPAK@X
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 656B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ