e:\sz\x64\release\InCSRSS.pdb
Static task
static1
Behavioral task
behavioral1
Sample
aad40957bcb83c9ecf0893946e13f3d3_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
aad40957bcb83c9ecf0893946e13f3d3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
aad40957bcb83c9ecf0893946e13f3d3_JaffaCakes118
-
Size
52KB
-
MD5
aad40957bcb83c9ecf0893946e13f3d3
-
SHA1
6f6786ceab1d9d6dcef20df9dacf6f1bb319ca72
-
SHA256
dcfe2601f95712ecb8a3f84e7c7866ac00867a6b64144d54deceefc6c7baf8b7
-
SHA512
755c207cb01cdb570af557b8502501c1d8755ba5d567c909ecf22c089539153acca851a54aba5bca9f21636e0c7f8657348de9af7dd5ef654b53bf982c1b67c7
-
SSDEEP
768:DK4XLuUlpQ55jWpHwAsRzYlkAWs/RP7Ae4UZ3OWnG7fBJSsM/G1bFFFYFefOFJYe:tXiwpMWOneiqRn4KeWnHg4
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource aad40957bcb83c9ecf0893946e13f3d3_JaffaCakes118
Files
-
aad40957bcb83c9ecf0893946e13f3d3_JaffaCakes118.dll windows:5 windows x64 arch:x64
49527f3b1c18703d1c79e8af09c77a3c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
ntdll
ZwSetValueKey
ZwSetInformationObject
ZwNotifyChangeKey
ZwOpenKey
ZwOpenProcessToken
ZwAdjustPrivilegesToken
ZwCreateEvent
ZwWaitForSingleObject
RtlImageNtHeader
RtlImageDirectoryEntryToData
LdrProcessRelocationBlock
ZwQueryInformationProcess
ZwReadVirtualMemory
RtlEqualUnicodeString
memcpy
ZwOpenProcess
ZwOpenThread
ZwQueryInformationThread
ZwAllocateVirtualMemory
ZwWriteVirtualMemory
ZwQueueApcThread
LdrFindEntryForAddress
swprintf
RtlInitUnicodeString
memset
strcpy
ZwCreateFile
ZwWriteFile
ZwCreateSection
ZwDeleteFile
memcmp
wcsstr
ZwQueryValueKey
ZwCreateSymbolicLinkObject
ZwClose
ZwDeviceIoControlFile
ZwOpenFile
RtlExitUserThread
ZwQuerySystemInformation
LdrUnloadDll
__chkstk
kernel32
LoadLibraryW
GetProcAddress
CreateThread
LoadLibraryA
VirtualAlloc
Sleep
SleepEx
VirtualFree
DisableThreadLibraryCalls
Exports
Exports
ConServerDllInitialization
Sections
.text Size: 43KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 808B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 180B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 246B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ