P:\agpytGedhRC\zMjjpihrt\nthJsLbZewv\RkpJRFQ\utyywyiszvygbq.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aaf263b04c6953f844a3695de524b9be_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
aaf263b04c6953f844a3695de524b9be_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
aaf263b04c6953f844a3695de524b9be_JaffaCakes118
-
Size
81KB
-
MD5
aaf263b04c6953f844a3695de524b9be
-
SHA1
54ce647fce456fadc2053702fc827cc4dade40dd
-
SHA256
cf58ec44c9b21a233ed634b22e7351e3acbdb97376f33f88e078e34b218f8751
-
SHA512
cbf53003fdef9ce0ba64c2b0a7e5525c36f1a3c4d4ac7972607ffd55c69442ab9da0a1792b97f89a07056019f48aa7db72955c0a1e897fd5f1d7d053ab6593e6
-
SSDEEP
768:ZsudB9dS13EVCkBsDvHKDf6AC8Mi2EjlBHHqH1vMDmkVGWX06:Zsu1de33vHKb6A0+pH6yy0X0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aaf263b04c6953f844a3695de524b9be_JaffaCakes118
Files
-
aaf263b04c6953f844a3695de524b9be_JaffaCakes118.dll windows:5 windows x86 arch:x86
84d5df4eef78db2cc80bdd7cdb0c32ed
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlCreateUnicodeString
RtlInitializeUnicodePrefix
PsGetCurrentProcess
RtlFindLastBackwardRunClear
MmUnmapIoSpace
ExReleaseFastMutexUnsafe
IoReleaseVpbSpinLock
ExUuidCreate
ZwEnumerateValueKey
FsRtlIsFatDbcsLegal
PsGetCurrentThread
RtlPrefixUnicodeString
ZwOpenKey
MmFreeMappingAddress
FsRtlAllocateFileLock
KeInitializeDpc
RtlSubAuthoritySid
RtlFindMostSignificantBit
KeInitializeSemaphore
IoQueryFileInformation
ZwFreeVirtualMemory
PsGetThreadProcessId
KeLeaveCriticalRegion
KeInsertHeadQueue
ExGetSharedWaiterCount
PsDereferencePrimaryToken
IoSetStartIoAttributes
SeQueryInformationToken
RtlInitUnicodeString
KeGetCurrentThread
RtlClearBits
CcPreparePinWrite
ExLocalTimeToSystemTime
ExCreateCallback
IoReleaseCancelSpinLock
IoAllocateMdl
KeSynchronizeExecution
RtlCompareMemory
CcRepinBcb
KeClearEvent
KeSaveFloatingPointState
ExAllocatePoolWithQuota
IoUpdateShareAccess
WmiQueryTraceInformation
MmAllocateContiguousMemory
ObInsertObject
IoStopTimer
KeInitializeSpinLock
MmSetAddressRangeModified
IoGetRequestorProcess
IoFreeMdl
RtlUnicodeStringToAnsiString
RtlIsNameLegalDOS8Dot3
ZwDeleteValueKey
KeFlushQueuedDpcs
IoWMIRegistrationControl
IoConnectInterrupt
RtlEqualSid
IoDeviceObjectType
KeSetKernelStackSwapEnable
RtlSetDaclSecurityDescriptor
IoInvalidateDeviceState
IoGetStackLimits
PoSetSystemState
IoVerifyVolume
KeRemoveByKeyDeviceQueue
ExReinitializeResourceLite
RtlFreeUnicodeString
KeCancelTimer
ZwCreateSection
IoCreateDisk
KeInsertByKeyDeviceQueue
KeQueryActiveProcessors
RtlTimeToTimeFields
MmUnmapLockedPages
RtlFindNextForwardRunClear
KeBugCheckEx
MmIsVerifierEnabled
ZwEnumerateKey
ZwClose
SeCaptureSubjectContext
MmMapIoSpace
IoFreeWorkItem
IoGetDeviceProperty
ExNotifyCallback
RtlCopyUnicodeString
IoIsWdmVersionAvailable
RtlUnicodeStringToOemString
ZwOpenFile
RtlEnumerateGenericTable
RtlDowncaseUnicodeString
IoBuildPartialMdl
MmFreePagesFromMdl
CcMdlWriteAbort
IoFreeController
IoGetDeviceInterfaces
RtlStringFromGUID
MmAllocatePagesForMdl
IoAllocateAdapterChannel
IoGetRelatedDeviceObject
FsRtlCheckLockForWriteAccess
IoGetTopLevelIrp
RtlInsertUnicodePrefix
ZwQueryObject
ExFreePool
RtlValidSecurityDescriptor
IoReleaseRemoveLockAndWaitEx
IoAllocateErrorLogEntry
MmAllocateNonCachedMemory
PsLookupThreadByThreadId
MmForceSectionClosed
MmUnlockPagableImageSection
IoDeleteController
MmBuildMdlForNonPagedPool
FsRtlSplitLargeMcb
IoDeleteSymbolicLink
ZwFlushKey
IoRaiseHardError
MmMapLockedPages
ExIsProcessorFeaturePresent
RtlInitializeGenericTable
KeSetBasePriorityThread
SeUnlockSubjectContext
MmMapLockedPagesSpecifyCache
MmIsThisAnNtAsSystem
ZwCreateFile
PsGetCurrentThreadId
ProbeForWrite
RtlFreeAnsiString
CcUnpinData
IoGetAttachedDeviceReference
PsGetProcessId
IoCsqRemoveIrp
MmUnlockPages
IoSetDeviceToVerify
MmSizeOfMdl
SeTokenIsRestricted
MmHighestUserAddress
RtlDelete
MmAllocateMappingAddress
RtlVolumeDeviceToDosName
IoGetBootDiskInformation
RtlIntegerToUnicodeString
PsGetProcessExitTime
IoCreateFile
IofCompleteRequest
RtlTimeFieldsToTime
RtlFindSetBits
KeRemoveQueue
IoAllocateWorkItem
IoSetSystemPartition
RtlNtStatusToDosError
KeDelayExecutionThread
RtlLengthRequiredSid
KeAttachProcess
IoCheckShareAccess
FsRtlCheckOplock
RtlCopyLuid
RtlUpperString
PsChargeProcessPoolQuota
CcMdlRead
RtlOemToUnicodeN
MmFreeNonCachedMemory
IoSetDeviceInterfaceState
RtlSetBits
KeDetachProcess
ExDeleteResourceLite
CcSetReadAheadGranularity
IoGetRequestorProcessId
RtlFindUnicodePrefix
RtlMapGenericMask
IoStartPacket
ExGetPreviousMode
IoEnumerateDeviceObjectList
SeSinglePrivilegeCheck
FsRtlFastUnlockSingle
RtlxAnsiStringToUnicodeSize
ObfReferenceObject
KeInsertQueueDpc
RtlCompareUnicodeString
CcIsThereDirtyData
RtlSecondsSince1980ToTime
ZwCreateEvent
RtlSecondsSince1970ToTime
PsReferencePrimaryToken
IoAllocateIrp
ExQueueWorkItem
KePulseEvent
CcCopyWrite
IoSetPartitionInformation
IoOpenDeviceRegistryKey
IoGetCurrentProcess
KeRundownQueue
IofCallDriver
ExRaiseAccessViolation
RtlInt64ToUnicodeString
ZwQueryInformationFile
MmPageEntireDriver
IoReportDetectedDevice
RtlWriteRegistryValue
CcSetFileSizes
PsRevertToSelf
IoWritePartitionTableEx
RtlUpperChar
MmAdvanceMdl
KeInitializeTimer
MmProbeAndLockProcessPages
ObOpenObjectByPointer
SeCreateClientSecurity
KeRemoveEntryDeviceQueue
RtlTimeToSecondsSince1970
PsImpersonateClient
RtlInitAnsiString
RtlFillMemoryUlong
IoReadPartitionTable
KeResetEvent
ZwQueryVolumeInformationFile
CcFastMdlReadWait
KeSetTimer
IoGetDeviceToVerify
KeSetSystemAffinityThread
IoUnregisterFileSystem
CcUninitializeCacheMap
SeTokenIsAdmin
ExSetResourceOwnerPointer
PsReturnPoolQuota
RtlUpcaseUnicodeToOemN
IoWMIWriteEvent
ZwSetSecurityObject
MmLockPagableSectionByHandle
ZwOpenSymbolicLinkObject
RtlHashUnicodeString
KeRemoveDeviceQueue
FsRtlMdlWriteCompleteDev
RtlAnsiCharToUnicodeChar
FsRtlIsHpfsDbcsLegal
RtlUpcaseUnicodeString
ExRaiseStatus
CcCopyRead
IoSetThreadHardErrorMode
SeQueryAuthenticationIdToken
MmQuerySystemSize
IoGetDmaAdapter
ExVerifySuite
IoQueueWorkItem
ExSystemTimeToLocalTime
IoThreadToProcess
RtlNumberOfClearBits
KeReadStateTimer
RtlSetAllBits
ObReleaseObjectSecurity
RtlAddAccessAllowedAce
KeInitializeApc
KeInitializeMutex
RtlFreeOemString
Exports
Exports
?ModifyPointer@@YGXKPAMH&U
?KillSectionEx@@YGPAJPAFG&U
?GenerateTextW@@YG_NM&U
?CrtProviderEx@@YGMI&U
?OnArgumentEx@@YGIDPAJ&U
?HideDeviceOld@@YGEPAKN&U
?DecrementComponentW@@YGXF&U
?FormatListOriginal@@YGFD&U
?RectExW@@YGPAXD&U
?GetModuleOriginal@@YGPANEJMK&U
?GetScreen@@YGHII&U
?EnumTaskA@@YGIM&U
?GenerateVersionOriginal@@YGIH&U
?CallMessage@@YGFPAFM&U
?KillExpressionOriginal@@YGPAX_NKKK&U
?IsMediaTypeA@@YGHH&U
?ModifyHeightW@@YGJKE_NN&U
?IncrementScreenExW@@YGXPAFKPAIPAE&U
?FormatDirectoryA@@YGMGMG&U
?IsNotFunctionOriginal@@YGPAHPAK&U
?SendProjectExW@@YGPAEJD&U
?ValidateWindowNew@@YGPADFDJPAG&U
?GeneratePointerOriginal@@YG_NJ&U
?InvalidateAnchorOriginal@@YGIKGK&U
?OnStateA@@YGPAFGPAD&U
?DeleteFolderA@@YGPAMPAGIK&U
?EnumHeaderW@@YGKPAK&U
?CopyProfileEx@@YGPAXGJGD&U
?SendTaskExA@@YGPAKPAEH&U
?KillMonitorEx@@YGPAFG&U
?IsTextEx@@YG_NDPAJJ&U
?SendConfig@@YGPAGKDDK&U
?PutListA@@YGNPAKI&U
?GlobalListItemExA@@YGJKDMPAH&U
?PutHeightA@@YGPAJFPAM&U
?CloseTaskNew@@YGJEG&U
?HideFullNameA@@YGKMHI&U
?IsValidStateOld@@YGHJ&U
Sections
.text Size: 26KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 653B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ