V:\genPzymrU\tewkAggg\ShjztptV.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bcf445fe06d35ac807cacd03db549d88_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bcf445fe06d35ac807cacd03db549d88_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bcf445fe06d35ac807cacd03db549d88_JaffaCakes118
-
Size
39KB
-
MD5
bcf445fe06d35ac807cacd03db549d88
-
SHA1
f426f1bc4899f0b47af5f0b021fa1617737f6e92
-
SHA256
1024e204fc5c049327533177e7cd2e528193733859d4061f4becf78f9778123d
-
SHA512
6d85eb51654ded21640a322675b49f71147d1b8827651c5de0aca492e3dce1c27bf3c02952bdca304bda2483d3f76e1d641ef7504cc3d1795b0d95e3a6ab1fae
-
SSDEEP
768:re3NBanuU3dfLcjqVAYrDaK6/SA3GKIDVdYmrnfQsUU5F:r0NBanuUNT7eK6/P6nIsf3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bcf445fe06d35ac807cacd03db549d88_JaffaCakes118
Files
-
bcf445fe06d35ac807cacd03db549d88_JaffaCakes118.dll windows:5 windows x86 arch:x86
99362f27cedb18190823d254d440804c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeRemoveQueueDpc
ExRaiseDatatypeMisalignment
KeReadStateTimer
RtlLengthSecurityDescriptor
KeClearEvent
IoUpdateShareAccess
RtlCharToInteger
RtlSubAuthoritySid
IoGetBootDiskInformation
RtlxAnsiStringToUnicodeSize
ExAcquireFastMutexUnsafe
RtlNtStatusToDosError
SeValidSecurityDescriptor
KeRemoveByKeyDeviceQueue
ExSystemTimeToLocalTime
RtlRemoveUnicodePrefix
IoAllocateController
ZwCreateKey
KeEnterCriticalRegion
RtlGetVersion
RtlFillMemoryUlong
KeInitializeTimer
IoStartNextPacket
RtlGUIDFromString
IoRaiseHardError
IoWMIRegistrationControl
RtlCopyUnicodeString
MmMapLockedPagesSpecifyCache
MmPageEntireDriver
IoCreateNotificationEvent
IoGetDmaAdapter
ZwOpenFile
KeQueryInterruptTime
RtlMultiByteToUnicodeN
KeInsertDeviceQueue
IoAttachDeviceToDeviceStack
ZwMakeTemporaryObject
KeStackAttachProcess
RtlxUnicodeStringToAnsiSize
IoStopTimer
DbgBreakPointWithStatus
IoAllocateIrp
SeQueryInformationToken
ZwEnumerateKey
PsGetCurrentProcessId
RtlFindNextForwardRunClear
RtlCopyLuid
ZwQueryInformationFile
IoInitializeTimer
RtlSecondsSince1980ToTime
RtlInitAnsiString
FsRtlCheckOplock
IoGetDeviceProperty
IoBuildSynchronousFsdRequest
KeSetTimer
RtlAppendUnicodeToString
KeQueryActiveProcessors
FsRtlIsFatDbcsLegal
SeDeleteObjectAuditAlarm
RtlUnicodeStringToAnsiString
IoInvalidateDeviceRelations
KeSetEvent
ExVerifySuite
IoCreateSynchronizationEvent
RtlCheckRegistryKey
PoCallDriver
IoWriteErrorLogEntry
IoQueueWorkItem
RtlGetNextRange
KdEnableDebugger
IoCreateDevice
RtlMapGenericMask
RtlUpperChar
KeBugCheckEx
RtlAppendStringToString
MmResetDriverPaging
MmMapIoSpace
KeInitializeEvent
RtlEqualString
MmUnmapLockedPages
ExGetPreviousMode
KeWaitForSingleObject
SeCaptureSubjectContext
RtlValidSid
ExGetExclusiveWaiterCount
RtlDeleteRegistryValue
ExLocalTimeToSystemTime
PsGetCurrentThread
KeInitializeApc
SeAssignSecurity
RtlAreBitsSet
FsRtlLookupLastLargeMcbEntry
ZwOpenProcess
RtlSecondsSince1970ToTime
IoStartPacket
IoFreeWorkItem
PsIsThreadTerminating
ExNotifyCallback
RtlAreBitsClear
RtlCopySid
IoSetSystemPartition
KeSetPriorityThread
ExFreePoolWithTag
ExInitializeResourceLite
RtlStringFromGUID
RtlClearAllBits
ZwQueryObject
ZwDeviceIoControlFile
FsRtlIsTotalDeviceFailure
PoRequestPowerIrp
KeRemoveDeviceQueue
CcZeroData
KeRemoveQueue
CcFastCopyRead
KeInsertByKeyDeviceQueue
ZwEnumerateValueKey
RtlFindLongestRunClear
IoSetThreadHardErrorMode
MmCanFileBeTruncated
MmProbeAndLockPages
ZwCreateDirectoryObject
ZwQuerySymbolicLinkObject
KeQueryTimeIncrement
SeTokenIsRestricted
ExReleaseFastMutexUnsafe
KeReleaseMutex
IoFreeController
ZwClose
IoReuseIrp
IoGetAttachedDeviceReference
MmSetAddressRangeModified
FsRtlSplitLargeMcb
IoDeleteSymbolicLink
IoDetachDevice
RtlFindUnicodePrefix
MmUnlockPages
ExAllocatePoolWithTag
ZwOpenSymbolicLinkObject
RtlEqualSid
KeResetEvent
MmIsVerifierEnabled
CcFastMdlReadWait
RtlRandom
MmAdvanceMdl
RtlDowncaseUnicodeString
RtlSetAllBits
IoGetAttachedDevice
FsRtlIsNameInExpression
FsRtlFastCheckLockForRead
ObReferenceObjectByHandle
IoAllocateWorkItem
FsRtlCheckLockForReadAccess
RtlUpcaseUnicodeToOemN
IoInvalidateDeviceState
MmLockPagableDataSection
ZwOpenSection
RtlFindSetBits
MmFreeContiguousMemory
ZwOpenKey
IoIsWdmVersionAvailable
KeFlushQueuedDpcs
MmFreeNonCachedMemory
RtlCompareMemory
SeQueryAuthenticationIdToken
FsRtlFastUnlockSingle
KeDeregisterBugCheckCallback
MmGetSystemRoutineAddress
IoAcquireCancelSpinLock
ExDeletePagedLookasideList
ExGetSharedWaiterCount
RtlFindMostSignificantBit
MmUnmapIoSpace
KeRundownQueue
PoStartNextPowerIrp
KeRemoveEntryDeviceQueue
IoGetDeviceObjectPointer
PsLookupProcessByProcessId
PsGetCurrentThreadId
ZwDeleteValueKey
KeLeaveCriticalRegion
IoStartTimer
FsRtlDeregisterUncProvider
FsRtlGetNextFileLock
ExAcquireResourceSharedLite
KeInitializeTimerEx
FsRtlIsDbcsInExpression
Exports
Exports
?FindProviderA@@YGPAMDPAJPADPAI~U
?GetMemoryExA@@YGGMMPADPA_N~U
?IsValidPenOriginal@@YGMK_N~U
?SendComponentA@@YGFN~U
?FormatPenOriginal@@YGKPAIKPA_N~U
?ModifyExpression@@YGPAIHGGF~U
?IsObjectEx@@YGPAHIK~U
?CopySemaphoreNew@@YGGKK~U
?GlobalFullNameNew@@YGKMPAHPAK~U
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vars1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vars4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vptr1 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr2 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr3 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vptr4 Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 616B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ