F:\jbkomdeRoArfwc\dmokYLFbacAI\RgzeoxmklnF\xMVXqftYLmeCy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
8dc91e87bcf9093e8e2a8eb5551f26ad_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8dc91e87bcf9093e8e2a8eb5551f26ad_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8dc91e87bcf9093e8e2a8eb5551f26ad_JaffaCakes118
-
Size
445KB
-
MD5
8dc91e87bcf9093e8e2a8eb5551f26ad
-
SHA1
d7db2413f3f863473955ad2860f4ecf48ac822c1
-
SHA256
a32a4866c82118ab43a17a60488d8b28466d9a5f89dba2441233ac149b80fa76
-
SHA512
ecdf82744efda5eb9f4d5c739b60f6d7746c0561d9e690fe64508b19687541cb8cb996d47d9e278017aa9ca7ffce32841a8771f265d964b933a4b25dd2af1fd9
-
SSDEEP
6144:vekCnJyM/MwFLtYgG3e/z/Wv+uKfoERTX/SYq6W8mjxng0k/yAYgJ9wq:WkCU0FLtYgG3e/KWuKfGXlgPZ9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8dc91e87bcf9093e8e2a8eb5551f26ad_JaffaCakes118
Files
-
8dc91e87bcf9093e8e2a8eb5551f26ad_JaffaCakes118.dll windows:5 windows x86 arch:x86
799fa1122d81421a8cbdfe1b05d1aa90
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoWMIWriteEvent
KeSetTimerEx
IoDisconnectInterrupt
SeReleaseSubjectContext
MmSizeOfMdl
CcFastCopyWrite
IoSetTopLevelIrp
FsRtlNotifyInitializeSync
IoSetSystemPartition
DbgPrompt
MmGetPhysicalAddress
RtlCreateSecurityDescriptor
ZwLoadDriver
CcUnpinDataForThread
RtlFindMostSignificantBit
ExFreePool
KeClearEvent
ExAllocatePoolWithQuota
RtlFreeUnicodeString
IoCreateStreamFileObject
PsLookupProcessByProcessId
RtlTimeToSecondsSince1980
KeLeaveCriticalRegion
KeRemoveEntryDeviceQueue
RtlInsertUnicodePrefix
KeStackAttachProcess
RtlVerifyVersionInfo
IoGetBootDiskInformation
ExNotifyCallback
RtlInitAnsiString
MmLockPagableSectionByHandle
IoCreateSynchronizationEvent
SeFilterToken
ExSetTimerResolution
ZwReadFile
ExAllocatePool
MmIsVerifierEnabled
IoBuildSynchronousFsdRequest
KeSetSystemAffinityThread
CcMapData
KeSetBasePriorityThread
IoAllocateWorkItem
MmUnmapIoSpace
RtlSetAllBits
IoUnregisterFileSystem
MmAllocateMappingAddress
IoGetDeviceInterfaceAlias
FsRtlCheckLockForReadAccess
SeQueryAuthenticationIdToken
RtlIsNameLegalDOS8Dot3
IoCreateDevice
IoRegisterFileSystem
SeCreateClientSecurity
CcFlushCache
KeEnterCriticalRegion
RtlxAnsiStringToUnicodeSize
ZwAllocateVirtualMemory
ExLocalTimeToSystemTime
CcIsThereDirtyData
ExAllocatePoolWithTag
MmAddVerifierThunks
MmUnlockPages
KeCancelTimer
CcMdlReadComplete
IoGetRequestorProcess
KeReleaseSemaphore
ExSystemTimeToLocalTime
MmUnmapLockedPages
CcCopyRead
KeReadStateMutex
IoReadDiskSignature
RtlUpperString
RtlInitializeSid
KeInsertQueueDpc
SeDeassignSecurity
IoReleaseCancelSpinLock
RtlUpcaseUnicodeChar
ZwOpenSection
ZwUnloadDriver
PsTerminateSystemThread
KeRevertToUserAffinityThread
IoBuildPartialMdl
RtlRandom
SeOpenObjectAuditAlarm
IoVerifyPartitionTable
IoGetDeviceAttachmentBaseRef
IoCsqRemoveIrp
SeQueryInformationToken
ZwCreateDirectoryObject
PoSetSystemState
IoCancelIrp
KeSetTargetProcessorDpc
RtlMapGenericMask
CcZeroData
IoMakeAssociatedIrp
RtlFindLeastSignificantBit
IoDeleteDevice
CcDeferWrite
RtlCharToInteger
IoWriteErrorLogEntry
CcMdlRead
ExReleaseFastMutexUnsafe
MmAdvanceMdl
ObReferenceObjectByPointer
ExRaiseStatus
HalExamineMBR
ExUuidCreate
ZwNotifyChangeKey
CcUnpinRepinnedBcb
KeDeregisterBugCheckCallback
RtlCopyUnicodeString
IoQueryDeviceDescription
CcGetFileObjectFromBcb
KeSetEvent
KeQueryTimeIncrement
IoQueryFileInformation
KeRemoveDeviceQueue
KeQueryActiveProcessors
IoQueueWorkItem
RtlDeleteNoSplay
RtlLengthSid
CcMdlWriteComplete
RtlInt64ToUnicodeString
FsRtlFreeFileLock
IoStartPacket
RtlEqualUnicodeString
PsGetCurrentProcess
CcSetBcbOwnerPointer
KeReadStateSemaphore
RtlEnumerateGenericTable
ExDeleteNPagedLookasideList
FsRtlFastCheckLockForRead
ZwQueryVolumeInformationFile
IoCreateFile
RtlLengthRequiredSid
RtlCompareUnicodeString
MmAllocateContiguousMemory
PsRevertToSelf
IoReleaseRemoveLockEx
CcRepinBcb
IoGetStackLimits
RtlAddAccessAllowedAce
ExCreateCallback
IoAllocateController
ExRegisterCallback
IoQueryFileDosDeviceName
IoReportResourceForDetection
KeInsertDeviceQueue
IoRegisterDeviceInterface
RtlUnicodeStringToAnsiString
MmMapIoSpace
RtlRemoveUnicodePrefix
FsRtlIsTotalDeviceFailure
RtlAnsiCharToUnicodeChar
KeWaitForMultipleObjects
FsRtlNotifyUninitializeSync
KeSetImportanceDpc
IoReleaseVpbSpinLock
IoCreateSymbolicLink
RtlSecondsSince1980ToTime
ExDeletePagedLookasideList
CcPinRead
RtlSplay
KeFlushQueuedDpcs
PsGetProcessId
MmMapLockedPagesSpecifyCache
PsGetProcessExitTime
SeAccessCheck
ProbeForRead
IoInitializeTimer
CcSetReadAheadGranularity
KeInsertHeadQueue
ExAcquireFastMutexUnsafe
IoInitializeIrp
ExVerifySuite
RtlFindSetBits
ZwFsControlFile
KePulseEvent
CcMdlWriteAbort
ZwCreateFile
IoCreateDisk
RtlAppendUnicodeToString
ObfDereferenceObject
IoGetDeviceObjectPointer
MmFreeMappingAddress
IoSetDeviceInterfaceState
RtlSubAuthoritySid
IoRequestDeviceEject
RtlUnicodeStringToOemString
ZwMapViewOfSection
MmUnsecureVirtualMemory
SeLockSubjectContext
IoRaiseHardError
RtlDowncaseUnicodeString
IoIsOperationSynchronous
MmSetAddressRangeModified
ZwClose
MmFreeNonCachedMemory
KeBugCheckEx
RtlEqualSid
IofCompleteRequest
KeInitializeApc
PsLookupThreadByThreadId
KeInitializeMutex
KeInitializeEvent
ObQueryNameString
ExFreePoolWithTag
RtlCompareMemory
MmResetDriverPaging
IoReuseIrp
ObfReferenceObject
CcFastCopyRead
MmHighestUserAddress
KeInitializeQueue
FsRtlIsNameInExpression
RtlWriteRegistryValue
IoReportDetectedDevice
KeInitializeDpc
SeSetSecurityDescriptorInfo
KeRemoveQueueDpc
SeUnlockSubjectContext
FsRtlSplitLargeMcb
PoCallDriver
RtlPrefixUnicodeString
ExGetExclusiveWaiterCount
IoConnectInterrupt
KeReadStateTimer
SeTokenIsRestricted
RtlSecondsSince1970ToTime
FsRtlMdlWriteCompleteDev
RtlCheckRegistryKey
RtlFindLongestRunClear
ExAllocatePoolWithQuotaTag
RtlQueryRegistryValues
FsRtlLookupLastLargeMcbEntry
IoGetDriverObjectExtension
IoAcquireCancelSpinLock
MmCanFileBeTruncated
IoAllocateIrp
ZwPowerInformation
ZwDeleteKey
RtlIntegerToUnicodeString
ZwQuerySymbolicLinkObject
PoSetPowerState
PsGetCurrentThreadId
RtlInitializeUnicodePrefix
IoReadPartitionTable
IoFreeIrp
IoVolumeDeviceToDosName
RtlFindLastBackwardRunClear
CcUnpinData
CcPreparePinWrite
IoGetDeviceToVerify
FsRtlDeregisterUncProvider
IoAllocateErrorLogEntry
ObInsertObject
KeRegisterBugCheckCallback
IoInvalidateDeviceState
RtlxUnicodeStringToAnsiSize
Exports
Exports
?FormatDirectory@@YGHNPADFPAD&U
?RemoveNameExA@@YGJPAF&U
?CrtValueEx@@YGMEFH&U
?LoadChar@@YGXPAF&U
?DeleteNameOld@@YGJPAHPAG&U
?InvalidateHeightW@@YGNDNPAD&U
?AddFileOriginal@@YGXPAKPAFIPAK&U
?ShowMessageA@@YGJG&U
?DecrementDataW@@YGPAKPAKFF&U
?AddScreenNew@@YGKEEPAH&U
?IsValidFolderNew@@YGEGNPAM&U
?ShowHeaderNew@@YGKPAHDI&U
?FindTimeOriginal@@YGGPAMG&U
?CloseProviderW@@YGPAHDFPAH&U
?IsNotDataA@@YGEDMI&U
?IsValidSystemExA@@YGXEPA_NPAHK&U
?RemoveMemoryOriginal@@YGJHPAED&U
?HideMonitorNew@@YGPAGPAEPAN&U
?DeleteTextW@@YGXD&U
?ShowFunctionOriginal@@YGXID&U
?ShowAnchorExW@@YGXPAD&U
?GetValueOld@@YGFPAFHEPAJ&U
?OnFilePathOld@@YGGPAMIPAK&U
?PutDateA@@YGJ_NM&U
?FindDialogEx@@YGPAMPAG&U
?FreeName@@YGJPAFJD&U
?IncrementMutexOriginal@@YGHEJD&U
?GenerateSystemExA@@YGPAFPAFPAN&U
?SetDialogEx@@YGPAMPAHHEPAK&U
?WindowOld@@YGIPAF&U
?ValidatePenOriginal@@YGPAGI&U
?SetVersionNew@@YGX_NPAIM&U
Sections
.text Size: 28KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 314B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 676B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ