H:\ecqklXfvOsx\icpuYpgjTwtbcL\ZXhFQynpww\jlnIdPmq\qqrddogVvEr.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b1ad6f706f48855e11eb610ea91f4745_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b1ad6f706f48855e11eb610ea91f4745_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b1ad6f706f48855e11eb610ea91f4745_JaffaCakes118
-
Size
37KB
-
MD5
b1ad6f706f48855e11eb610ea91f4745
-
SHA1
e3173ff6e43a19463294cc9c6fa22af211495093
-
SHA256
15d8c559aa18810449c6f95e43e6ac6bf051c77346eb7b2130cb1664bc9331de
-
SHA512
89a1e20046585642e74f3fd31d3f42af3a01de2df2d1345ed5d1f8a8aa4438992367e14b1fa154c673336d7d5cc6f63544df085a749c73c4bf67a65cfb558c16
-
SSDEEP
768:DHiuGlwfjLpIyiZaBUFRJSMRrYS6ke8LQwn4T4CQji:DHiuhfjLSyi86XJSMRrQke8l4T4CQ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b1ad6f706f48855e11eb610ea91f4745_JaffaCakes118
Files
-
b1ad6f706f48855e11eb610ea91f4745_JaffaCakes118.dll windows:5 windows x86 arch:x86
b0662b427c0b4ff5fcd8d464cb2c3bbd
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoAllocateErrorLogEntry
MmUnmapIoSpace
RtlGenerate8dot3Name
RtlFindSetBits
IoCreateFile
IoCreateSynchronizationEvent
IoReportDetectedDevice
MmIsThisAnNtAsSystem
IoFreeIrp
SeTokenIsRestricted
SeSinglePrivilegeCheck
IoQueueWorkItem
KeClearEvent
ObfDereferenceObject
RtlSplay
IoRegisterFileSystem
IoInitializeIrp
IoDeleteDevice
KeSaveFloatingPointState
SeTokenIsAdmin
RtlUpcaseUnicodeString
ExIsProcessorFeaturePresent
IoVerifyPartitionTable
KeRemoveByKeyDeviceQueue
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoEnumerateDeviceObjectList
RtlCharToInteger
RtlFindNextForwardRunClear
PsGetCurrentThread
SeAccessCheck
IoIsSystemThread
IoGetBootDiskInformation
ProbeForRead
ExGetPreviousMode
RtlInitAnsiString
PoCallDriver
RtlAnsiCharToUnicodeChar
IoInitializeRemoveLockEx
KeInitializeApc
FsRtlIsDbcsInExpression
ExLocalTimeToSystemTime
RtlUpperString
MmAllocateMappingAddress
ZwReadFile
RtlVerifyVersionInfo
KeResetEvent
IoGetRequestorProcessId
RtlDeleteElementGenericTable
RtlOemToUnicodeN
IoRemoveShareAccess
RtlUpperChar
FsRtlNotifyUninitializeSync
SeReleaseSubjectContext
MmUnlockPagableImageSection
IoReadDiskSignature
IoGetDiskDeviceObject
IoGetCurrentProcess
ZwWriteFile
MmCanFileBeTruncated
MmAllocateNonCachedMemory
ExDeleteNPagedLookasideList
IoFreeErrorLogEntry
IoSetShareAccess
RtlClearBits
PsGetProcessId
IoInvalidateDeviceState
RtlTimeToSecondsSince1970
IoVerifyVolume
ObfReferenceObject
IoGetRequestorProcess
PoUnregisterSystemState
ExReleaseFastMutexUnsafe
IoGetDeviceAttachmentBaseRef
MmIsDriverVerifying
KeGetCurrentThread
KeQueryTimeIncrement
HalExamineMBR
MmMapUserAddressesToPage
PsGetCurrentThreadId
ZwQueryValueKey
IoCreateDevice
RtlCompareMemory
MmAdvanceMdl
ZwLoadDriver
RtlFindUnicodePrefix
ExUnregisterCallback
ExReleaseResourceLite
PoSetPowerState
ExFreePoolWithTag
RtlSecondsSince1980ToTime
IoUpdateShareAccess
SeUnlockSubjectContext
SeFilterToken
ZwOpenFile
PoStartNextPowerIrp
RtlAddAccessAllowedAceEx
RtlRemoveUnicodePrefix
IoSetTopLevelIrp
SeSetSecurityDescriptorInfo
ExReinitializeResourceLite
ZwSetSecurityObject
IoUnregisterFileSystem
SeLockSubjectContext
RtlLengthRequiredSid
PsDereferencePrimaryToken
MmUnsecureVirtualMemory
KeCancelTimer
FsRtlGetNextFileLock
MmUnmapReservedMapping
RtlAreBitsClear
IofCompleteRequest
FsRtlIsFatDbcsLegal
RtlIntegerToUnicodeString
RtlDowncaseUnicodeString
RtlxOemStringToUnicodeSize
DbgBreakPoint
IoRaiseHardError
ExFreePool
PsIsThreadTerminating
RtlFindLeastSignificantBit
CcFastCopyRead
ZwPowerInformation
IoCreateStreamFileObject
KeInitializeTimerEx
KeSetSystemAffinityThread
SePrivilegeCheck
CcMapData
MmMapLockedPagesSpecifyCache
CcMdlRead
PsRevertToSelf
KeReadStateSemaphore
ObReferenceObjectByPointer
ExAllocatePool
KeWaitForSingleObject
ExAcquireResourceSharedLite
IoBuildSynchronousFsdRequest
CcInitializeCacheMap
MmFreeContiguousMemory
ZwNotifyChangeKey
SeQueryInformationToken
FsRtlCheckLockForWriteAccess
IoWriteErrorLogEntry
PsLookupThreadByThreadId
MmPageEntireDriver
IoDeleteSymbolicLink
RtlWriteRegistryValue
CcSetBcbOwnerPointer
CcSetDirtyPinnedData
RtlUnicodeToMultiByteN
RtlClearAllBits
MmSetAddressRangeModified
MmGetPhysicalAddress
IoGetDeviceProperty
ZwOpenSection
IoOpenDeviceRegistryKey
SeAppendPrivileges
KeDetachProcess
RtlSetAllBits
CcMdlReadComplete
PoRequestPowerIrp
RtlUnicodeStringToInteger
ObMakeTemporaryObject
IoSetStartIoAttributes
KeInitializeMutex
PsTerminateSystemThread
IoAllocateController
ZwQueryObject
ZwDeleteValueKey
IoSetPartitionInformation
KeSetKernelStackSwapEnable
CcFastMdlReadWait
MmProbeAndLockProcessPages
RtlSubAuthoritySid
MmBuildMdlForNonPagedPool
RtlInitializeSid
ZwMakeTemporaryObject
RtlPrefixUnicodeString
KeReleaseMutex
KeStackAttachProcess
KeQuerySystemTime
PsGetThreadProcessId
ExSetResourceOwnerPointer
KeEnterCriticalRegion
RtlAddAccessAllowedAce
IoRequestDeviceEject
IoGetStackLimits
IoSetDeviceInterfaceState
KdEnableDebugger
RtlAppendUnicodeToString
IoAcquireVpbSpinLock
RtlGetNextRange
FsRtlLookupLastLargeMcbEntry
CcPurgeCacheSection
SeImpersonateClientEx
KeInitializeDeviceQueue
RtlCompareString
IoGetDeviceInterfaces
SeDeassignSecurity
FsRtlAllocateFileLock
IoCheckShareAccess
FsRtlDeregisterUncProvider
IoAcquireCancelSpinLock
ZwSetValueKey
IoFreeMdl
RtlCreateRegistryKey
MmMapLockedPages
IofCallDriver
IoInitializeTimer
IoSetPartitionInformationEx
IoGetRelatedDeviceObject
CcPinRead
RtlCompareUnicodeString
RtlValidSid
KeLeaveCriticalRegion
IoAllocateAdapterChannel
IoGetDeviceObjectPointer
PsImpersonateClient
ZwCreateKey
PsReferencePrimaryToken
ExAllocatePoolWithTag
IoAllocateIrp
RtlSecondsSince1970ToTime
SeOpenObjectAuditAlarm
RtlInt64ToUnicodeString
CcFastCopyWrite
PsLookupProcessByProcessId
KeInitializeSemaphore
KeReleaseSemaphore
IoDeviceObjectType
CcUnpinDataForThread
RtlDeleteRegistryValue
IoCheckEaBufferValidity
KeQueryActiveProcessors
RtlFreeAnsiString
KeBugCheck
RtlMapGenericMask
FsRtlFastUnlockSingle
KeRegisterBugCheckCallback
KeDelayExecutionThread
MmResetDriverPaging
ZwClose
ZwOpenKey
ObCreateObject
ZwQuerySymbolicLinkObject
KeRemoveQueueDpc
IoIsOperationSynchronous
RtlIsNameLegalDOS8Dot3
PsSetLoadImageNotifyRoutine
MmProbeAndLockPages
RtlEqualString
ExRaiseDatatypeMisalignment
RtlxUnicodeStringToAnsiSize
RtlAnsiStringToUnicodeString
Sections
.text Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.t_i Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t_e Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t_p Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 828B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 532B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ