D:\lgzUQBtOx\jUmdhcuero\vvwdWmlqpkTs\dLSSdvsjbtRHTO.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8d444d0095befb2c1114f63fd725663e_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8d444d0095befb2c1114f63fd725663e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8d444d0095befb2c1114f63fd725663e_JaffaCakes118
-
Size
61KB
-
MD5
8d444d0095befb2c1114f63fd725663e
-
SHA1
546225b5c6c8eef2311bb8140eaa6580fe5203bb
-
SHA256
d037bb9e1e3e09b63c10281aedbdfb83d386b89274b0fb8c3a53c7bb980d58b5
-
SHA512
ace0eabb13e70375e6ab48a997d506079e6225f9a5e2e6454bc61b18463c5d69cc7a2724d6827660b40f07a3d7d1a6eacccee324ab358ca84f90602e9a793d85
-
SSDEEP
768:1S+4wRaCaW0XKrsXyJxBq+9KbjqdocDEbfxiu2u3V1owLY7UqMWP08MchCd2mrvm:1DhOSsiJ6iDE1Wu3VMMWsPcsdR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8d444d0095befb2c1114f63fd725663e_JaffaCakes118
Files
-
8d444d0095befb2c1114f63fd725663e_JaffaCakes118.dll windows:5 windows x86 arch:x86
2529df9073d935f931eeeabeb7a1bf6b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
FsRtlIsHpfsDbcsLegal
RtlCreateAcl
ZwCreateDirectoryObject
KeSetSystemAffinityThread
KeQueryTimeIncrement
MmIsAddressValid
CcDeferWrite
RtlSetAllBits
IoCreateNotificationEvent
IofCompleteRequest
RtlUnicodeStringToOemString
KeInsertDeviceQueue
MmSizeOfMdl
VerSetConditionMask
IoSetTopLevelIrp
SeOpenObjectAuditAlarm
FsRtlAllocateFileLock
RtlMultiByteToUnicodeN
KeSetTargetProcessorDpc
RtlGenerate8dot3Name
RtlCompareUnicodeString
KeRevertToUserAffinityThread
FsRtlNotifyUninitializeSync
KeReadStateMutex
ObReferenceObjectByHandle
MmAdvanceMdl
IoSetPartitionInformation
ExAllocatePool
ExDeletePagedLookasideList
IoGetAttachedDevice
ZwFreeVirtualMemory
KdEnableDebugger
CcSetReadAheadGranularity
RtlClearBits
MmGetSystemRoutineAddress
MmProbeAndLockProcessPages
IoSetShareAccess
ZwClose
PsGetVersion
IoGetTopLevelIrp
IoMakeAssociatedIrp
RtlSetDaclSecurityDescriptor
ExUuidCreate
DbgPrompt
RtlUnicodeToMultiByteN
RtlHashUnicodeString
MmForceSectionClosed
RtlLengthRequiredSid
KeReleaseMutex
ExQueueWorkItem
ZwQueryInformationFile
IoAllocateController
KeSetImportanceDpc
IoSetDeviceToVerify
ExNotifyCallback
PsGetCurrentProcessId
RtlInitUnicodeString
RtlCreateUnicodeString
RtlUpcaseUnicodeToOemN
RtlQueryRegistryValues
RtlCopyUnicodeString
IoGetRelatedDeviceObject
ExDeleteNPagedLookasideList
RtlDeleteRegistryValue
SeQueryInformationToken
RtlSecondsSince1970ToTime
IoAllocateErrorLogEntry
KeSetEvent
MmIsThisAnNtAsSystem
PsLookupProcessByProcessId
IoGetDriverObjectExtension
KeSynchronizeExecution
ExAllocatePoolWithQuota
IoGetRequestorProcessId
MmGetPhysicalAddress
FsRtlIsNameInExpression
CcCanIWrite
IoGetRequestorProcess
RtlGetCallersAddress
PsGetCurrentThread
RtlSecondsSince1980ToTime
SeDeleteObjectAuditAlarm
IoCheckQuotaBufferValidity
IoOpenDeviceRegistryKey
IoIsSystemThread
ZwFsControlFile
IoFreeController
ObGetObjectSecurity
RtlDowncaseUnicodeString
KeSetPriorityThread
KeBugCheck
ZwCreateEvent
SeAppendPrivileges
MmFreeContiguousMemory
ZwPowerInformation
FsRtlCheckLockForWriteAccess
IoFreeIrp
FsRtlCheckOplock
ZwMapViewOfSection
IoWriteErrorLogEntry
RtlLengthSid
MmProbeAndLockPages
ObInsertObject
IoSetHardErrorOrVerifyDevice
IoGetDeviceToVerify
SePrivilegeCheck
SeAccessCheck
SeUnlockSubjectContext
RtlVerifyVersionInfo
IoAllocateAdapterChannel
MmUnsecureVirtualMemory
IoIsWdmVersionAvailable
ExVerifySuite
ExRaiseStatus
RtlClearAllBits
SeCreateClientSecurity
RtlAnsiCharToUnicodeChar
KeResetEvent
RtlFindMostSignificantBit
ExIsProcessorFeaturePresent
RtlInitAnsiString
ExAcquireResourceSharedLite
KeDeregisterBugCheckCallback
MmSetAddressRangeModified
KeRegisterBugCheckCallback
RtlFindLeastSignificantBit
MmMapLockedPages
RtlAppendStringToString
IoConnectInterrupt
IoAllocateWorkItem
MmAllocateContiguousMemory
MmIsVerifierEnabled
PoStartNextPowerIrp
ObReferenceObjectByPointer
RtlValidSecurityDescriptor
RtlValidSid
RtlFreeUnicodeString
IoGetDeviceAttachmentBaseRef
ExDeleteResourceLite
RtlxUnicodeStringToAnsiSize
ZwAllocateVirtualMemory
FsRtlIsDbcsInExpression
RtlUpperString
RtlCompareMemory
SeFreePrivileges
RtlCharToInteger
PoCallDriver
KeReadStateSemaphore
RtlUnicodeStringToAnsiString
KeQueryActiveProcessors
KefAcquireSpinLockAtDpcLevel
ExGetSharedWaiterCount
ZwQueryVolumeInformationFile
PsReturnPoolQuota
IoAllocateIrp
ExUnregisterCallback
MmBuildMdlForNonPagedPool
IoStartNextPacket
RtlEqualSid
KeInsertByKeyDeviceQueue
IoGetDeviceInterfaces
PsGetProcessExitTime
RtlEnumerateGenericTable
KeGetCurrentThread
IoGetLowerDeviceObject
ObOpenObjectByPointer
IoInvalidateDeviceState
KeInitializeSpinLock
RtlInitializeSid
RtlEqualUnicodeString
CcRepinBcb
IoFreeWorkItem
RtlCheckRegistryKey
RtlExtendedIntegerMultiply
MmMapLockedPagesSpecifyCache
RtlDeleteElementGenericTable
IoGetDeviceObjectPointer
RtlRemoveUnicodePrefix
IoWritePartitionTableEx
IoReadPartitionTable
SeCaptureSubjectContext
IoReleaseCancelSpinLock
KeInitializeEvent
IoSetDeviceInterfaceState
IoInitializeTimer
ObQueryNameString
CcUnpinRepinnedBcb
CcMdlReadComplete
RtlInsertUnicodePrefix
IoGetDiskDeviceObject
RtlFindClearBits
ZwReadFile
RtlOemToUnicodeN
ZwCreateSection
PsIsThreadTerminating
IoStopTimer
MmUnmapReservedMapping
ZwOpenSection
KeWaitForMultipleObjects
IoQueryDeviceDescription
IoInitializeIrp
ZwCreateFile
MmMapUserAddressesToPage
ExRegisterCallback
IoDisconnectInterrupt
RtlGetNextRange
IoQueueWorkItem
ObReleaseObjectSecurity
ZwWriteFile
CcInitializeCacheMap
SeQueryAuthenticationIdToken
RtlInt64ToUnicodeString
PsGetProcessId
RtlDelete
RtlCopyString
IoBuildPartialMdl
KeInitializeQueue
IoCsqRemoveIrp
MmAllocateMappingAddress
PoRegisterSystemState
MmUnlockPages
ZwDeleteKey
IoCreateStreamFileObject
RtlTimeToSecondsSince1970
ZwOpenFile
KeCancelTimer
MmFreeNonCachedMemory
IofCallDriver
KeFlushQueuedDpcs
MmFreeMappingAddress
SeLockSubjectContext
RtlSubAuthoritySid
ProbeForWrite
ZwDeleteValueKey
IoDetachDevice
ZwFlushKey
RtlAreBitsClear
KeReadStateEvent
KeSetTimerEx
RtlTimeToTimeFields
RtlUnicodeStringToInteger
CcPinRead
RtlWriteRegistryValue
RtlUnicodeToOemN
IoVolumeDeviceToDosName
IoReportResourceForDetection
IoGetDmaAdapter
CcFastCopyRead
IoVerifyPartitionTable
ZwSetValueKey
MmIsDriverVerifying
MmQuerySystemSize
FsRtlCheckLockForReadAccess
KeRemoveQueue
IoInvalidateDeviceRelations
RtlMapGenericMask
IoSetSystemPartition
Exports
Exports
?FreeDateTimeExW@@IJPAMG@X
?IsDialogNew@@IJPAHPAIPAD@X
?InvalidateThread@@IJPAIGPAJ@X
?SetSectionExA@@IJ_NEFJPAM@X
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vars1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vptr1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 556B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ