Z:\rzHbcmrxkipjYi\ullNlZE\bfbjwfb\FeFTBtHiRvdvkf\bYQJcoIgMR.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bbcff9ad8d88ee7560c52f23e00d63c0_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bbcff9ad8d88ee7560c52f23e00d63c0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bbcff9ad8d88ee7560c52f23e00d63c0_JaffaCakes118
-
Size
159KB
-
MD5
bbcff9ad8d88ee7560c52f23e00d63c0
-
SHA1
57d0144059900cb05df193cc0af3a3823b91b075
-
SHA256
f398abfc5b5c7793c0f2cd3d0e5ee23177e5c1ab38f62b5c471bfcf96c225ebe
-
SHA512
cd587d81d508ea46ff620fa6b3bf59eb4e68419179315c0bb2ade48c7a9d52c02a1d7643bb1d31a5675f18cd5e47457d34d20d3d360945c9183cfbb8ca3c68e4
-
SSDEEP
3072:8HQ4Slxp+MkOVLAiJn0C2cJaJFs0r9gkJKqDm+TAnBRjvt:8wzz+MFVUS0C2ckJ4f+iBRjv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bbcff9ad8d88ee7560c52f23e00d63c0_JaffaCakes118
Files
-
bbcff9ad8d88ee7560c52f23e00d63c0_JaffaCakes118.dll windows:5 windows x86 arch:x86
4ac76e30c677e3a59ab5046cdd951f4f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoCreateStreamFileObject
IoAllocateAdapterChannel
RtlFindClearRuns
KeSetTimer
MmFreeNonCachedMemory
ObQueryNameString
RtlUpcaseUnicodeChar
RtlCreateSecurityDescriptor
CcGetFileObjectFromBcb
IoGetDeviceObjectPointer
RtlOemStringToUnicodeString
ZwFsControlFile
FsRtlIsFatDbcsLegal
FsRtlIsTotalDeviceFailure
IoCreateDevice
ZwOpenFile
RtlInitializeBitMap
IoReleaseCancelSpinLock
CcSetFileSizes
RtlSecondsSince1980ToTime
ObReleaseObjectSecurity
RtlxUnicodeStringToAnsiSize
KeFlushQueuedDpcs
RtlUnicodeStringToOemString
MmSizeOfMdl
MmAllocatePagesForMdl
PoUnregisterSystemState
ExReleaseResourceLite
RtlStringFromGUID
ZwOpenSection
ExRaiseDatatypeMisalignment
CcMdlWriteComplete
ZwDeleteValueKey
RtlSplay
IoGetDmaAdapter
IoWMIWriteEvent
KePulseEvent
KeEnterCriticalRegion
MmFreeContiguousMemory
IoIsOperationSynchronous
ProbeForRead
IoReportResourceForDetection
RtlTimeFieldsToTime
ZwDeleteKey
KeInitializeDeviceQueue
IoAllocateController
SeLockSubjectContext
RtlUpperString
IoAllocateMdl
IoMakeAssociatedIrp
CcFastMdlReadWait
SeTokenIsRestricted
IoAllocateErrorLogEntry
SeImpersonateClientEx
FsRtlLookupLastLargeMcbEntry
CcIsThereDirtyData
RtlTimeToTimeFields
PsGetCurrentThread
IoGetRequestorProcess
RtlCompareString
ExAllocatePool
IoFreeMdl
RtlRemoveUnicodePrefix
CcMdlWriteAbort
RtlLengthSecurityDescriptor
ZwReadFile
IoGetAttachedDevice
MmProbeAndLockProcessPages
KeWaitForMultipleObjects
IoInvalidateDeviceState
MmAddVerifierThunks
RtlNtStatusToDosError
KeInitializeEvent
IoReadPartitionTableEx
RtlAddAccessAllowedAceEx
PoSetSystemState
IoGetCurrentProcess
ExRaiseStatus
ExCreateCallback
FsRtlMdlWriteCompleteDev
IoGetLowerDeviceObject
KdDisableDebugger
ZwCreateFile
ZwOpenKey
ZwQueryVolumeInformationFile
RtlClearAllBits
ExGetSharedWaiterCount
ZwOpenProcess
KeBugCheck
RtlFillMemoryUlong
ObCreateObject
IoVerifyPartitionTable
ZwOpenSymbolicLinkObject
RtlUnicodeStringToInteger
RtlInitializeSid
ZwCreateSection
PsSetLoadImageNotifyRoutine
SeFilterToken
RtlCopyString
KeClearEvent
RtlFindNextForwardRunClear
KeSaveFloatingPointState
IoFreeController
RtlCreateRegistryKey
RtlInt64ToUnicodeString
ObfDereferenceObject
IoCreateSynchronizationEvent
IoSetDeviceToVerify
ExFreePoolWithTag
MmFreePagesFromMdl
RtlSetDaclSecurityDescriptor
KeRemoveQueue
IoReleaseRemoveLockEx
ZwPowerInformation
CcUnpinDataForThread
KeSetTargetProcessorDpc
MmFreeMappingAddress
FsRtlCheckOplock
SePrivilegeCheck
IoQueryFileDosDeviceName
RtlExtendedIntegerMultiply
PsTerminateSystemThread
KeStackAttachProcess
KeGetCurrentThread
MmUnmapLockedPages
RtlAreBitsSet
PsLookupProcessByProcessId
ZwAllocateVirtualMemory
ExAcquireFastMutexUnsafe
IoCreateStreamFileObjectLite
MmHighestUserAddress
SeDeassignSecurity
RtlInitUnicodeString
KeInitializeDpc
CcPreparePinWrite
HalExamineMBR
VerSetConditionMask
SeUnlockSubjectContext
PoSetPowerState
RtlNumberOfClearBits
CcSetDirtyPinnedData
IoCheckShareAccess
RtlInsertUnicodePrefix
PsChargeProcessPoolQuota
ExAllocatePoolWithTag
MmAllocateMappingAddress
ZwQueryInformationFile
MmFlushImageSection
SeDeleteObjectAuditAlarm
MmForceSectionClosed
RtlUnicodeToMultiByteN
FsRtlAllocateFileLock
PsDereferencePrimaryToken
DbgBreakPointWithStatus
MmIsVerifierEnabled
FsRtlGetNextFileLock
IoBuildPartialMdl
RtlFreeUnicodeString
FsRtlFreeFileLock
RtlAppendUnicodeToString
IoAllocateIrp
IoWMIRegistrationControl
IoInitializeIrp
SeFreePrivileges
PsCreateSystemThread
RtlFreeOemString
IoStartNextPacket
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlUpperChar
IoThreadToProcess
RtlGUIDFromString
RtlRandom
RtlOemToUnicodeN
RtlMultiByteToUnicodeN
MmResetDriverPaging
IoGetRelatedDeviceObject
DbgPrompt
RtlCopyUnicodeString
CcRepinBcb
KeReadStateSemaphore
MmMapUserAddressesToPage
IofCompleteRequest
CcPinRead
IoDeviceObjectType
KeSetTimerEx
FsRtlFastCheckLockForRead
CcSetBcbOwnerPointer
ExDeleteNPagedLookasideList
KeInitializeTimer
RtlVolumeDeviceToDosName
SeAccessCheck
IoRegisterFileSystem
IoUpdateShareAccess
CcFlushCache
RtlTimeToSecondsSince1980
ExUnregisterCallback
IoGetAttachedDeviceReference
PsImpersonateClient
KeWaitForSingleObject
KeReadStateEvent
CcFastCopyRead
RtlUnicodeToOemN
PsGetCurrentProcess
RtlCreateAcl
RtlPrefixUnicodeString
MmLockPagableDataSection
RtlFindLastBackwardRunClear
FsRtlDeregisterUncProvider
IoInitializeRemoveLockEx
RtlValidSid
MmIsAddressValid
IoIsWdmVersionAvailable
ZwNotifyChangeKey
ObReferenceObjectByPointer
RtlGetVersion
MmBuildMdlForNonPagedPool
RtlQueryRegistryValues
RtlTimeToSecondsSince1970
ZwQueryObject
IoAcquireCancelSpinLock
IoDeleteSymbolicLink
RtlInitializeGenericTable
RtlGetNextRange
IoWriteErrorLogEntry
KeInitializeSemaphore
IoCancelIrp
IoGetRequestorProcessId
IoGetDeviceInterfaceAlias
KeInitializeTimerEx
MmMapIoSpace
RtlMapGenericMask
KeReleaseSemaphore
KeInsertQueue
FsRtlNotifyInitializeSync
RtlVerifyVersionInfo
IoRemoveShareAccess
ZwEnumerateKey
ZwSetVolumeInformationFile
MmAllocateContiguousMemory
IoSetHardErrorOrVerifyDevice
KeInitializeMutex
RtlEqualUnicodeString
KeRemoveDeviceQueue
SeCreateClientSecurity
RtlxAnsiStringToUnicodeSize
IoReadDiskSignature
KeInitializeSpinLock
KeSynchronizeExecution
RtlInitAnsiString
MmPageEntireDriver
IoReportDetectedDevice
MmMapLockedPagesSpecifyCache
ExReinitializeResourceLite
IoSetSystemPartition
RtlDelete
FsRtlCheckLockForWriteAccess
MmAdvanceMdl
KeQuerySystemTime
IoReleaseRemoveLockAndWaitEx
PsRevertToSelf
Exports
Exports
?CallWidthA@@IJXMPAG@X
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ