J:\eiupet\tttgx\hbfpjK\evetny.pdb
Static task
static1
Behavioral task
behavioral1
Sample
a136391a84d8a613f96a8a6f7e3396b0_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a136391a84d8a613f96a8a6f7e3396b0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a136391a84d8a613f96a8a6f7e3396b0_JaffaCakes118
-
Size
38KB
-
MD5
a136391a84d8a613f96a8a6f7e3396b0
-
SHA1
33dcd049d88dfd333f596931598ad62a3f757108
-
SHA256
3aa4f224422cbfdcda46f037326c3e69b054c1b030aaafa483dbcf6736e9dc39
-
SHA512
389f0ecb043a52e48d760dc7be4e66f714d04b43a3a54260a7a9b920f0a255263548c321d3fe2fc8f4c31aab35a9c0fd51a4da7be7fbd5bab204e099b1a12eb9
-
SSDEEP
768:bqyByKeVbczDeslCbFcZlH9oCzJND+ITRMxkl7TSS/eAty:bq8yKxveRF+N9zNDRRLt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a136391a84d8a613f96a8a6f7e3396b0_JaffaCakes118
Files
-
a136391a84d8a613f96a8a6f7e3396b0_JaffaCakes118.dll windows:5 windows x86 arch:x86
f28055789860cf01c44ae8732eeb3b7d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
SeAssignSecurity
ZwOpenFile
RtlValidSid
RtlCompareString
FsRtlIsNameInExpression
RtlEqualUnicodeString
RtlUpperChar
ZwReadFile
IoIsSystemThread
IoCheckShareAccess
FsRtlIsDbcsInExpression
FsRtlCheckLockForWriteAccess
FsRtlMdlWriteCompleteDev
MmIsDriverVerifying
ZwQueryObject
IoGetRelatedDeviceObject
IoSetHardErrorOrVerifyDevice
RtlEqualString
RtlGUIDFromString
ZwOpenKey
RtlWriteRegistryValue
RtlUpcaseUnicodeToOemN
RtlAnsiCharToUnicodeChar
RtlInitString
RtlTimeFieldsToTime
CcFastMdlReadWait
IoConnectInterrupt
RtlDowncaseUnicodeString
MmFreeContiguousMemory
Exports
Exports
?KZuKpAsQyTQbsmcdnaiFGD@@YGPAX_N@Z
Sections
.text Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 19KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ