S:\FyUmhjyffPk\TktYJqnDhHwh\eyxjnHq\uyhdBezMI\veldbbm.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ada18e07ec71aff098b1be4375263758_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ada18e07ec71aff098b1be4375263758_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ada18e07ec71aff098b1be4375263758_JaffaCakes118
-
Size
73KB
-
MD5
ada18e07ec71aff098b1be4375263758
-
SHA1
31290023042df6e8a89c2c7ebaca731c15f1f41f
-
SHA256
38d8dae302e20857326217c8faac867475ddb0ab5c7a17caa6b0e25e09db554f
-
SHA512
edc3dbfb23b50bbdaa6426cd065f82ca1e195d371fcde5836e3dd455e57bffd6ea88f2aa6b5773f805a9851f6a21e9a59691be59c52893dfe70f08bfb116dfe2
-
SSDEEP
768:9MMnFhZ8xn5l/m7/9ohC5us4ictKOFmZKu6QuOlyFomYa6IwoA59Fw/dptM22c0F:pnFhmnzS/9Bnc4JYOl9mv6CAi6HKs9
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ada18e07ec71aff098b1be4375263758_JaffaCakes118
Files
-
ada18e07ec71aff098b1be4375263758_JaffaCakes118.dll windows:5 windows x86 arch:x86
4ca11d08c581badd5db9f09f56b3648f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlSecondsSince1970ToTime
IoAllocateErrorLogEntry
ExVerifySuite
RtlInitializeBitMap
ObQueryNameString
FsRtlFastUnlockSingle
ExGetPreviousMode
PoSetSystemState
CcZeroData
RtlAreBitsClear
ExDeleteNPagedLookasideList
FsRtlAllocateFileLock
IoCreateStreamFileObjectLite
IoDetachDevice
RtlAppendStringToString
RtlFreeAnsiString
RtlEqualString
RtlCheckRegistryKey
SeCaptureSubjectContext
IoGetDriverObjectExtension
KeFlushQueuedDpcs
SeAssignSecurity
ZwOpenProcess
KeSetTimerEx
MmGetPhysicalAddress
FsRtlCheckOplock
IoOpenDeviceRegistryKey
ZwQueryObject
RtlFindLastBackwardRunClear
IoReleaseCancelSpinLock
IoGetDeviceObjectPointer
KeQueryActiveProcessors
IoCreateNotificationEvent
CcFastCopyWrite
KeQueryTimeIncrement
MmLockPagableDataSection
IoAllocateController
MmSetAddressRangeModified
RtlxUnicodeStringToAnsiSize
KeLeaveCriticalRegion
KeReadStateEvent
IoReuseIrp
FsRtlGetNextFileLock
MmUnmapIoSpace
KeRemoveByKeyDeviceQueue
ExUnregisterCallback
MmFreePagesFromMdl
SeImpersonateClientEx
KeSetPriorityThread
RtlxAnsiStringToUnicodeSize
IoGetRelatedDeviceObject
RtlMultiByteToUnicodeN
RtlRandom
FsRtlNotifyInitializeSync
KeSynchronizeExecution
PsGetCurrentThread
IoFreeController
IoStartTimer
PsLookupThreadByThreadId
ExAcquireFastMutexUnsafe
IoDeleteController
KeRegisterBugCheckCallback
IoSetHardErrorOrVerifyDevice
MmIsAddressValid
RtlMapGenericMask
IoConnectInterrupt
RtlAppendUnicodeToString
ExAcquireResourceSharedLite
IoGetBootDiskInformation
RtlInitString
RtlInsertUnicodePrefix
PsCreateSystemThread
IoInvalidateDeviceState
CcIsThereDirtyData
FsRtlCheckLockForWriteAccess
IoBuildSynchronousFsdRequest
ZwCreateFile
KeCancelTimer
IoRequestDeviceEject
ExRaiseAccessViolation
MmGetSystemRoutineAddress
PoUnregisterSystemState
KeSetTimer
FsRtlIsNameInExpression
ExGetExclusiveWaiterCount
ZwAllocateVirtualMemory
ExAllocatePoolWithTag
IoSetSystemPartition
RtlUpcaseUnicodeToOemN
PoStartNextPowerIrp
KeInsertQueue
MmUnsecureVirtualMemory
RtlUpperChar
RtlPrefixUnicodeString
KeQuerySystemTime
MmResetDriverPaging
RtlAnsiStringToUnicodeString
IoFreeIrp
RtlFindClearRuns
RtlUpperString
KeResetEvent
MmFreeNonCachedMemory
MmMapIoSpace
ObCreateObject
RtlFindMostSignificantBit
RtlAnsiCharToUnicodeChar
ObReleaseObjectSecurity
ZwOpenFile
ExReinitializeResourceLite
IoQueueWorkItem
KeInitializeTimer
ExRaiseStatus
ZwDeviceIoControlFile
RtlFindClearBitsAndSet
FsRtlIsFatDbcsLegal
IoCheckEaBufferValidity
IoCreateSymbolicLink
RtlGetVersion
IoWMIRegistrationControl
ExLocalTimeToSystemTime
ProbeForRead
ZwCreateSection
KeClearEvent
SeSinglePrivilegeCheck
RtlUnicodeToMultiByteN
KdEnableDebugger
IoGetDmaAdapter
MmLockPagableSectionByHandle
MmQuerySystemSize
ZwCreateKey
MmIsDriverVerifying
FsRtlFreeFileLock
ZwEnumerateKey
CcFastMdlReadWait
RtlNumberOfClearBits
FsRtlIsDbcsInExpression
RtlGetNextRange
IoCreateFile
MmAllocateNonCachedMemory
RtlEnumerateGenericTable
RtlTimeToSecondsSince1970
KeInitializeEvent
ExIsProcessorFeaturePresent
RtlTimeToTimeFields
RtlCopyUnicodeString
ZwFsControlFile
RtlInitAnsiString
CcUnpinDataForThread
RtlHashUnicodeString
ExReleaseResourceLite
RtlInitializeUnicodePrefix
IoDeviceObjectType
MmSizeOfMdl
ExGetSharedWaiterCount
MmCanFileBeTruncated
IoRaiseHardError
ZwOpenKey
CcSetBcbOwnerPointer
RtlUnicodeToOemN
ExDeletePagedLookasideList
SeDeassignSecurity
RtlCompareMemory
RtlCompareString
ExReleaseFastMutexUnsafe
MmUnlockPagableImageSection
PoSetPowerState
KeBugCheck
IoInvalidateDeviceRelations
RtlUpcaseUnicodeChar
KeInitializeSemaphore
IoMakeAssociatedIrp
FsRtlNotifyUninitializeSync
SeQueryInformationToken
ZwMapViewOfSection
SeTokenIsRestricted
IoGetCurrentProcess
RtlLengthRequiredSid
RtlRemoveUnicodePrefix
CcDeferWrite
IoCheckQuotaBufferValidity
RtlEqualSid
IoStopTimer
KeInitializeMutex
IoBuildPartialMdl
CcCopyRead
KeInitializeDpc
PsIsThreadTerminating
CcPreparePinWrite
ZwFreeVirtualMemory
PoRegisterSystemState
RtlQueryRegistryValues
RtlTimeFieldsToTime
IoGetAttachedDevice
IoStartNextPacket
KeDeregisterBugCheckCallback
ZwFlushKey
KeInsertDeviceQueue
IoDeleteSymbolicLink
IoGetAttachedDeviceReference
ExUuidCreate
ObReferenceObjectByPointer
KeRestoreFloatingPointState
MmPageEntireDriver
KeReadStateSemaphore
RtlUnicodeStringToInteger
ExDeleteResourceLite
KeInsertQueueDpc
FsRtlDeregisterUncProvider
RtlValidSecurityDescriptor
FsRtlFastCheckLockForRead
IoCancelIrp
IoAllocateMdl
RtlDeleteRegistryValue
PsGetCurrentThreadId
KeInitializeDeviceQueue
PsSetLoadImageNotifyRoutine
KeSetEvent
SeQueryAuthenticationIdToken
KeInitializeApc
PoCallDriver
RtlClearBits
RtlEqualUnicodeString
ExFreePoolWithTag
IoAttachDeviceToDeviceStack
MmAllocateContiguousMemory
PsGetVersion
KeInitializeSpinLock
KeWaitForMultipleObjects
RtlUnicodeStringToAnsiString
MmFreeContiguousMemory
RtlSecondsSince1980ToTime
IoAllocateIrp
ExSystemTimeToLocalTime
ExRegisterCallback
KeQueryInterruptTime
IoInitializeIrp
RtlSetDaclSecurityDescriptor
ZwQueryInformationFile
IoReportDetectedDevice
KdDisableDebugger
RtlCopySid
RtlClearAllBits
IoSetShareAccess
ExInitializeResourceLite
RtlFindLongestRunClear
SeOpenObjectAuditAlarm
ZwQueryValueKey
KeEnterCriticalRegion
RtlCharToInteger
ExNotifyCallback
IoCreateSynchronizationEvent
RtlFindClearBits
MmMapLockedPagesSpecifyCache
CcCopyWrite
KeInsertByKeyDeviceQueue
RtlAreBitsSet
RtlFindNextForwardRunClear
Sections
.text Size: 33KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 471B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 23KB - Virtual size: 53KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 652B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ