G:\NrvshE\vkNUSR\tjbodhj.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aaa16ce02152e26c484d6a84870e75a1_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aaa16ce02152e26c484d6a84870e75a1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
aaa16ce02152e26c484d6a84870e75a1_JaffaCakes118
-
Size
38KB
-
MD5
aaa16ce02152e26c484d6a84870e75a1
-
SHA1
130b823b5537b74d97eafd3bf6743a0bffadf1ef
-
SHA256
43aa76f2424773fc6a1f2faab4b11783b7dd756ac052248597bfa75140065782
-
SHA512
c9f1409de2b814937ca39b71ef52e2264b11a0a0d2b8c0ebb14ebbad8bd8064c47c85d840f7497a154e4855965e2fffa3d7714b55923dfbc4858027b2e5a33e1
-
SSDEEP
768:8gaZS9vG37fh6jDJohRS4sHdbi8rIYhjw:8Stm7fADJBRi8rIKjw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aaa16ce02152e26c484d6a84870e75a1_JaffaCakes118
Files
-
aaa16ce02152e26c484d6a84870e75a1_JaffaCakes118.dll windows:5 windows x86 arch:x86
b4d2e32e675c38c8c57ec2411c7b9877
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
ObReferenceObjectByHandle
CcPreparePinWrite
PsSetLoadImageNotifyRoutine
IoAcquireCancelSpinLock
CcFastMdlReadWait
PoStartNextPowerIrp
SeTokenIsRestricted
ZwQueryValueKey
IoSetHardErrorOrVerifyDevice
ZwAllocateVirtualMemory
KeBugCheckEx
IoGetAttachedDevice
RtlUpcaseUnicodeToOemN
RtlInitializeGenericTable
PoRegisterSystemState
IoRemoveShareAccess
RtlEqualUnicodeString
IoDetachDevice
RtlFindClearRuns
ZwOpenProcess
RtlUpcaseUnicodeString
ZwQuerySymbolicLinkObject
MmQuerySystemSize
ExFreePoolWithTag
Exports
Exports
?siHWyxfE@@YGNG@Z
?bpRydcbr@@YGKFPAD@Z
?rvWxDFfnfEhGQoHevsI@@YGPAXEI@Z
?ltzgioNJ@@YGDPAFK@Z
?sfodznqLTFqwhm@@YGPAFPAEH@Z
?lqtpvisn@@YGDGM@Z
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 257B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ