N:\hqybixq\fwueu\wbcu.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b5b80f9254f3bf8dac8df39f20677cbe_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b5b80f9254f3bf8dac8df39f20677cbe_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b5b80f9254f3bf8dac8df39f20677cbe_JaffaCakes118
-
Size
39KB
-
MD5
b5b80f9254f3bf8dac8df39f20677cbe
-
SHA1
49161ef0fa3755db8e271d5e1754f20659f5719f
-
SHA256
516c5fa69caf4c128bc6d666ad3c46f77ac526a39f5d4fc933d6986a22bae037
-
SHA512
1fbc0cdb0cb322ea578a6336751ce1f05c2c8d6edbae70d1d0518577fcab6eef1c808c39853c72777ea0573d40a2bc6fbc8db260338476249036f0d00ffd4fd2
-
SSDEEP
768:zFtJ95iLvVHCcvSXCMN5iTLZnMD7ow1Td5ILQMHEzLglr:J+CcvSSAiTLZnsTlHHMiL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b5b80f9254f3bf8dac8df39f20677cbe_JaffaCakes118
Files
-
b5b80f9254f3bf8dac8df39f20677cbe_JaffaCakes118.dll windows:5 windows x86 arch:x86
bb284eef1b7c02259b332d058988ba8b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlCompareString
IoCreateSymbolicLink
IoRequestDeviceEject
PsGetCurrentThread
RtlOemStringToUnicodeString
MmSetAddressRangeModified
RtlInitString
RtlAppendStringToString
RtlFindClearRuns
KeInsertDeviceQueue
RtlDowncaseUnicodeString
RtlUpperChar
RtlCompareMemory
MmFreePagesFromMdl
RtlQueryRegistryValues
ZwFsControlFile
ExReinitializeResourceLite
IoCreateDevice
RtlFindClearBits
KeReleaseMutex
RtlSecondsSince1970ToTime
KeSetImportanceDpc
KeInitializeQueue
IoAttachDeviceToDeviceStack
IoCreateStreamFileObjectLite
IoInvalidateDeviceRelations
Exports
Exports
?ZvAtSncCsglvs@@YGIPAMPAI@Z
?exjkUxrmfJjAbzl@@YGXPAEF@Z
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.itext Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ