E:\pHQECvUSzhOym\RhqcbBvtf\cfWyulvspXTfvh\gsUwoWvjoz\nVyjYujJjyjnmz.pdb
Static task
static1
Behavioral task
behavioral1
Sample
b81af2e497c76e089d2c596489d47e28_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b81af2e497c76e089d2c596489d47e28_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b81af2e497c76e089d2c596489d47e28_JaffaCakes118
-
Size
445KB
-
MD5
b81af2e497c76e089d2c596489d47e28
-
SHA1
8d42ac8ca853c9ef00046a8c9e1ec34d238e6855
-
SHA256
f75dc48be0a8375155cd5f312838ad4daad234401eee60ec906de421dc5a7bae
-
SHA512
a11a0d31ce4f54d344c16df84ba633c147db5ec0400cd357baba5e4d9f067f954a9b4dd4e14e2257dd3105d15e2dc341111bed35ac2a59675a0ba1236c2f93f0
-
SSDEEP
12288:GweHz6NyOPuKt1eUApSRYdFWGxt+vFX3k:heT6IOMpSRYdFWGxkvFH
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b81af2e497c76e089d2c596489d47e28_JaffaCakes118
Files
-
b81af2e497c76e089d2c596489d47e28_JaffaCakes118.dll windows:5 windows x86 arch:x86
62258214c05ac8f21a3b5c578655160d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoCheckQuotaBufferValidity
ZwCreateKey
DbgBreakPoint
IoAllocateIrp
IoCreateStreamFileObjectLite
KeSynchronizeExecution
IoReadPartitionTableEx
KeInitializeQueue
IoInvalidateDeviceState
MmAllocateMappingAddress
ExSystemTimeToLocalTime
RtlTimeToSecondsSince1970
IoGetTopLevelIrp
RtlNumberOfClearBits
KeQueryInterruptTime
KeGetCurrentThread
IoGetRelatedDeviceObject
IoFreeIrp
IoUnregisterFileSystem
RtlCopyUnicodeString
IoConnectInterrupt
KeTickCount
IoSetPartitionInformation
CcFastCopyWrite
IoInvalidateDeviceRelations
CcUninitializeCacheMap
ObReleaseObjectSecurity
RtlFindClearBitsAndSet
KeReadStateMutex
MmForceSectionClosed
MmFreePagesFromMdl
RtlCharToInteger
IoSetThreadHardErrorMode
CcMdlRead
RtlTimeFieldsToTime
IoIsWdmVersionAvailable
KeInsertByKeyDeviceQueue
PsReferencePrimaryToken
IoReadDiskSignature
RtlVerifyVersionInfo
ZwSetSecurityObject
IoGetBootDiskInformation
RtlFreeOemString
MmUnsecureVirtualMemory
SeAccessCheck
ZwQueryObject
PsChargeProcessPoolQuota
DbgBreakPointWithStatus
KeEnterCriticalRegion
ExDeletePagedLookasideList
CcGetFileObjectFromBcb
ObfReferenceObject
MmFreeMappingAddress
IoGetDeviceProperty
CcRepinBcb
KeClearEvent
ZwEnumerateKey
ZwCreateSection
RtlEqualUnicodeString
IoThreadToProcess
ExCreateCallback
CcPreparePinWrite
SeDeassignSecurity
IoGetInitialStack
CcSetReadAheadGranularity
ZwWriteFile
RtlCreateSecurityDescriptor
RtlEqualString
RtlDeleteNoSplay
KeWaitForSingleObject
RtlCreateAcl
CcUnpinData
KeLeaveCriticalRegion
KeSetTimerEx
IoCancelIrp
IoSetHardErrorOrVerifyDevice
KeInitializeTimer
RtlCheckRegistryKey
Exports
Exports
?LoadFilePathExA@@YGHK<V
?ModifyWindowInfoA@@YGFPAN<V
?RtlMonitorOld@@YGXK_NK<V
?KillKeyNameW@@YGMJE<V
?GetFile@@YGXPADHPAJPA_N<V
?InvalidateFileExA@@YGIPAKK<V
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vdat Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 924B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ