Z:\rzHbcmrxkipjYi\ullNlZE\bfbjwfb\FeFTBtHiRvdvkf\bYQJcoIgMR.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8869a24b7dbe593b0ac35f5f021e7ddd_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8869a24b7dbe593b0ac35f5f021e7ddd_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8869a24b7dbe593b0ac35f5f021e7ddd_JaffaCakes118
-
Size
267KB
-
MD5
8869a24b7dbe593b0ac35f5f021e7ddd
-
SHA1
200f5a06632f1ed282f4239d45aaf4b14d7b86bc
-
SHA256
66c5718fe43edd7cbab9b132d2c61aac12d6a403ed67945e6e104d76204c83d4
-
SHA512
26601ac217d74c081141278dbeebbf46044f22e22479a57ac1411e8ca858d0905a5b04aeefe3166f1a65c9857b607cc6677fde4681d4727402e53c28ae582e79
-
SSDEEP
6144:Dwnz+MFVUTwVwette322cmfGSwk/Nj1uni:DwnzdAKCLOS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8869a24b7dbe593b0ac35f5f021e7ddd_JaffaCakes118
Files
-
8869a24b7dbe593b0ac35f5f021e7ddd_JaffaCakes118.dll windows:5 windows x86 arch:x86
4ac76e30c677e3a59ab5046cdd951f4f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoCreateStreamFileObject
IoAllocateAdapterChannel
RtlFindClearRuns
KeSetTimer
MmFreeNonCachedMemory
ObQueryNameString
RtlUpcaseUnicodeChar
RtlCreateSecurityDescriptor
CcGetFileObjectFromBcb
IoGetDeviceObjectPointer
RtlOemStringToUnicodeString
ZwFsControlFile
FsRtlIsFatDbcsLegal
FsRtlIsTotalDeviceFailure
IoCreateDevice
ZwOpenFile
RtlInitializeBitMap
IoReleaseCancelSpinLock
CcSetFileSizes
RtlSecondsSince1980ToTime
ObReleaseObjectSecurity
RtlxUnicodeStringToAnsiSize
KeFlushQueuedDpcs
RtlUnicodeStringToOemString
MmSizeOfMdl
MmAllocatePagesForMdl
PoUnregisterSystemState
ExReleaseResourceLite
RtlStringFromGUID
ZwOpenSection
ExRaiseDatatypeMisalignment
CcMdlWriteComplete
ZwDeleteValueKey
RtlSplay
IoGetDmaAdapter
IoWMIWriteEvent
KePulseEvent
KeEnterCriticalRegion
MmFreeContiguousMemory
IoIsOperationSynchronous
ProbeForRead
IoReportResourceForDetection
RtlTimeFieldsToTime
ZwDeleteKey
KeInitializeDeviceQueue
IoAllocateController
SeLockSubjectContext
RtlUpperString
IoAllocateMdl
IoMakeAssociatedIrp
CcFastMdlReadWait
SeTokenIsRestricted
IoAllocateErrorLogEntry
SeImpersonateClientEx
FsRtlLookupLastLargeMcbEntry
CcIsThereDirtyData
RtlTimeToTimeFields
PsGetCurrentThread
IoGetRequestorProcess
RtlCompareString
ExAllocatePool
IoFreeMdl
RtlRemoveUnicodePrefix
CcMdlWriteAbort
RtlLengthSecurityDescriptor
ZwReadFile
IoGetAttachedDevice
MmProbeAndLockProcessPages
KeWaitForMultipleObjects
IoInvalidateDeviceState
MmAddVerifierThunks
RtlNtStatusToDosError
KeInitializeEvent
IoReadPartitionTableEx
RtlAddAccessAllowedAceEx
PoSetSystemState
IoGetCurrentProcess
ExRaiseStatus
ExCreateCallback
FsRtlMdlWriteCompleteDev
IoGetLowerDeviceObject
KdDisableDebugger
ZwCreateFile
ZwOpenKey
ZwQueryVolumeInformationFile
RtlClearAllBits
ExGetSharedWaiterCount
ZwOpenProcess
KeBugCheck
RtlFillMemoryUlong
ObCreateObject
IoVerifyPartitionTable
ZwOpenSymbolicLinkObject
RtlUnicodeStringToInteger
RtlInitializeSid
ZwCreateSection
PsSetLoadImageNotifyRoutine
SeFilterToken
RtlCopyString
KeClearEvent
RtlFindNextForwardRunClear
KeSaveFloatingPointState
IoFreeController
RtlCreateRegistryKey
RtlInt64ToUnicodeString
ObfDereferenceObject
IoCreateSynchronizationEvent
IoSetDeviceToVerify
ExFreePoolWithTag
MmFreePagesFromMdl
RtlSetDaclSecurityDescriptor
KeRemoveQueue
IoReleaseRemoveLockEx
ZwPowerInformation
CcUnpinDataForThread
KeSetTargetProcessorDpc
MmFreeMappingAddress
FsRtlCheckOplock
SePrivilegeCheck
IoQueryFileDosDeviceName
RtlExtendedIntegerMultiply
PsTerminateSystemThread
KeStackAttachProcess
KeGetCurrentThread
MmUnmapLockedPages
RtlAreBitsSet
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ExAcquireFastMutexUnsafe
IoCreateStreamFileObjectLite
MmHighestUserAddress
SeDeassignSecurity
RtlInitUnicodeString
KeInitializeDpc
CcPreparePinWrite
HalExamineMBR
VerSetConditionMask
SeUnlockSubjectContext
PoSetPowerState
RtlNumberOfClearBits
CcSetDirtyPinnedData
IoCheckShareAccess
RtlInsertUnicodePrefix
PsChargeProcessPoolQuota
ExAllocatePoolWithTag
MmAllocateMappingAddress
ZwQueryInformationFile
MmFlushImageSection
SeDeleteObjectAuditAlarm
MmForceSectionClosed
RtlUnicodeToMultiByteN
FsRtlAllocateFileLock
PsDereferencePrimaryToken
DbgBreakPointWithStatus
MmIsVerifierEnabled
FsRtlGetNextFileLock
IoBuildPartialMdl
RtlFreeUnicodeString
FsRtlFreeFileLock
RtlAppendUnicodeToString
IoAllocateIrp
IoWMIRegistrationControl
IoInitializeIrp
SeFreePrivileges
PsCreateSystemThread
RtlFreeOemString
IoStartNextPacket
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlUpperChar
IoThreadToProcess
RtlGUIDFromString
RtlRandom
RtlOemToUnicodeN
RtlMultiByteToUnicodeN
MmResetDriverPaging
IoGetRelatedDeviceObject
DbgPrompt
RtlCopyUnicodeString
CcRepinBcb
KeReadStateSemaphore
MmMapUserAddressesToPage
IofCompleteRequest
CcPinRead
IoDeviceObjectType
KeSetTimerEx
FsRtlFastCheckLockForRead
CcSetBcbOwnerPointer
ExDeleteNPagedLookasideList
KeInitializeTimer
RtlVolumeDeviceToDosName
SeAccessCheck
IoRegisterFileSystem
IoUpdateShareAccess
CcFlushCache
RtlTimeToSecondsSince1980
ExUnregisterCallback
IoGetAttachedDeviceReference
PsImpersonateClient
KeWaitForSingleObject
KeReadStateEvent
CcFastCopyRead
RtlUnicodeToOemN
PsGetCurrentProcess
RtlCreateAcl
RtlPrefixUnicodeString
MmLockPagableDataSection
RtlFindLastBackwardRunClear
FsRtlDeregisterUncProvider
IoInitializeRemoveLockEx
RtlValidSid
MmIsAddressValid
IoIsWdmVersionAvailable
ZwNotifyChangeKey
ObReferenceObjectByPointer
RtlGetVersion
MmBuildMdlForNonPagedPool
RtlQueryRegistryValues
RtlTimeToSecondsSince1970
ZwQueryObject
IoAcquireCancelSpinLock
IoDeleteSymbolicLink
RtlInitializeGenericTable
RtlGetNextRange
IoWriteErrorLogEntry
KeInitializeSemaphore
IoCancelIrp
IoGetRequestorProcessId
IoGetDeviceInterfaceAlias
KeInitializeTimerEx
MmMapIoSpace
RtlMapGenericMask
KeReleaseSemaphore
KeInsertQueue
FsRtlNotifyInitializeSync
RtlVerifyVersionInfo
IoRemoveShareAccess
ZwEnumerateKey
ZwSetVolumeInformationFile
MmAllocateContiguousMemory
IoSetHardErrorOrVerifyDevice
KeInitializeMutex
RtlEqualUnicodeString
KeRemoveDeviceQueue
SeCreateClientSecurity
RtlxAnsiStringToUnicodeSize
IoReadDiskSignature
KeInitializeSpinLock
KeSynchronizeExecution
RtlInitAnsiString
MmPageEntireDriver
IoReportDetectedDevice
MmMapLockedPagesSpecifyCache
ExReinitializeResourceLite
IoSetSystemPartition
RtlDelete
FsRtlCheckLockForWriteAccess
MmAdvanceMdl
KeQuerySystemTime
IoReleaseRemoveLockAndWaitEx
PsRevertToSelf
Exports
Exports
?CallWidthA@@IJXMPAG@X
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ