W:\epseRHz\zrsmvlct\apjtuzMjkipSqb\fugRddvwozgOPV.pdb
Static task
static1
Behavioral task
behavioral1
Sample
9554b86d07bbe52b0ec041598aa9f1d9_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
9554b86d07bbe52b0ec041598aa9f1d9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
9554b86d07bbe52b0ec041598aa9f1d9_JaffaCakes118
-
Size
106KB
-
MD5
9554b86d07bbe52b0ec041598aa9f1d9
-
SHA1
184e39595bee9f61576e8590ea83974a2fc608b4
-
SHA256
064593e5999f49e7cddc0be5026181e855a778989fbe65bc3fcebfa0b8d718fc
-
SHA512
90d3653a68be430c19c5b34fabc4cc84e3fbe66bfec2e8199041d20bfef5b89b0d603d0a00080e592f9ace3828903d934b7d26a74674d3825a6d97a043a56668
-
SSDEEP
1536:sJUfKXm3ol89i1qycaeeBIJGwnFV/Qe3Md13DXo925bVn+KuwqjEwy:p+8DaiU+XQSMvzCIVnijEN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 9554b86d07bbe52b0ec041598aa9f1d9_JaffaCakes118
Files
-
9554b86d07bbe52b0ec041598aa9f1d9_JaffaCakes118.dll windows:5 windows x86 arch:x86
b5eef883b759a53f1a0caa357291350d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ExSetTimerResolution
IoAllocateErrorLogEntry
KeInitializeDpc
RtlUnicodeStringToOemString
RtlGetVersion
SeCaptureSubjectContext
IoVerifyPartitionTable
ExGetPreviousMode
ZwReadFile
KeEnterCriticalRegion
IoDeleteDevice
KeInitializeSemaphore
RtlCreateAcl
FsRtlNotifyUninitializeSync
RtlInitializeGenericTable
CcFlushCache
IoBuildPartialMdl
MmIsVerifierEnabled
ExDeleteResourceLite
IoReleaseVpbSpinLock
PsCreateSystemThread
KeInitializeQueue
KeDelayExecutionThread
FsRtlIsFatDbcsLegal
RtlCreateSecurityDescriptor
ExRegisterCallback
ObReferenceObjectByHandle
IoStartPacket
ObCreateObject
SeLockSubjectContext
IoGetDeviceProperty
KeGetCurrentThread
KeSetTargetProcessorDpc
RtlFindNextForwardRunClear
ZwDeleteValueKey
RtlWriteRegistryValue
IoGetInitialStack
CcMapData
KeTickCount
MmUnmapReservedMapping
FsRtlFastUnlockSingle
KeSetBasePriorityThread
ExAllocatePoolWithTag
KeInitializeSpinLock
KeLeaveCriticalRegion
ExRaiseAccessViolation
ObReleaseObjectSecurity
IoBuildSynchronousFsdRequest
MmMapLockedPagesSpecifyCache
Exports
Exports
?IsValidPointer@@YGPAIEH<V
?CallVersionOld@@YGPA_NPAHPAD<V
?IsNotStringW@@YGMIPAJ<V
?FormatDeviceEx@@YGHM<V
?IsDateTimeW@@YG_NJF<V
?InsertTextExA@@YGFKE<V
Sections
.text Size: 65KB - Virtual size: 91KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE