E:\gjQGopvg\nOaszqspTKYDfv\sgtUNphpBOCq\gzhiCiZ\lgbgbXcjAqheow.pdb
Static task
static1
Behavioral task
behavioral1
Sample
bd21b14274ca6bc1a0228a15e7f0895d_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
bd21b14274ca6bc1a0228a15e7f0895d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
bd21b14274ca6bc1a0228a15e7f0895d_JaffaCakes118
-
Size
106KB
-
MD5
bd21b14274ca6bc1a0228a15e7f0895d
-
SHA1
715c607d0ecea63bbf518bf9d7d6032938290075
-
SHA256
409b62cc94cfd24c46863a97063f22d7feb170780f7f29c6bf1320225f0bf5ab
-
SHA512
fd1cf83cac32e48f881820f726e4b654004c5c2d250602cce13e6f4d81b13927695e43776726209097e67bd41cc8707f953101d0d4a49f24933dacd56ee31855
-
SSDEEP
1536:KZ86rj8gM7k++W53SkJ7v+Wd9QybVn+KuwqjEwy:K7sGqXJ72OVnijEN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bd21b14274ca6bc1a0228a15e7f0895d_JaffaCakes118
Files
-
bd21b14274ca6bc1a0228a15e7f0895d_JaffaCakes118.dll windows:5 windows x86 arch:x86
429a30c19676a09add57176d480da14e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlDowncaseUnicodeString
RtlFindSetBits
MmUnmapIoSpace
IoRemoveShareAccess
KeSetTargetProcessorDpc
ZwCreateDirectoryObject
IoReportDetectedDevice
ExSetResourceOwnerPointer
KeSetKernelStackSwapEnable
KeReadStateTimer
IoDisconnectInterrupt
RtlWriteRegistryValue
RtlAppendUnicodeToString
IoGetRelatedDeviceObject
ExAcquireResourceSharedLite
ZwMakeTemporaryObject
PoStartNextPowerIrp
RtlInitializeBitMap
IoRequestDeviceEject
ExNotifyCallback
KeUnstackDetachProcess
KeSaveFloatingPointState
RtlFreeAnsiString
ObCreateObject
RtlUpperChar
IoCancelIrp
CcFastMdlReadWait
CcCopyRead
RtlStringFromGUID
KeQuerySystemTime
KeRemoveQueueDpc
ExUuidCreate
RtlxUnicodeStringToAnsiSize
ObReleaseObjectSecurity
IoReleaseCancelSpinLock
KeCancelTimer
MmResetDriverPaging
ZwCreateSection
ExSystemTimeToLocalTime
IoFreeMdl
IoReuseIrp
KeInitializeTimer
RtlLengthSecurityDescriptor
ExRaiseStatus
MmFreeNonCachedMemory
IoSetHardErrorOrVerifyDevice
CcIsThereDirtyData
RtlFindLongestRunClear
PoRequestPowerIrp
SeCaptureSubjectContext
RtlTimeToSecondsSince1980
RtlGetNextRange
ExRaiseAccessViolation
FsRtlNotifyUninitializeSync
SeDeassignSecurity
RtlCopySid
ExReleaseFastMutexUnsafe
RtlFindMostSignificantBit
PsCreateSystemThread
FsRtlIsNameInExpression
SeAccessCheck
ZwQueryObject
RtlFindUnicodePrefix
IoWMIRegistrationControl
ZwClose
ExFreePool
FsRtlLookupLastLargeMcbEntry
RtlFindClearBitsAndSet
PsGetCurrentProcessId
SeSinglePrivilegeCheck
IoCreateNotificationEvent
ZwDeleteValueKey
ZwAllocateVirtualMemory
IoCheckQuotaBufferValidity
MmGetSystemRoutineAddress
RtlCreateSecurityDescriptor
ObQueryNameString
FsRtlCheckLockForWriteAccess
KeSetImportanceDpc
RtlUnicodeStringToAnsiString
IoStartNextPacket
ZwReadFile
IoDeviceObjectType
ZwCreateFile
KeInitializeDeviceQueue
IoDetachDevice
ObGetObjectSecurity
KeClearEvent
FsRtlMdlWriteCompleteDev
RtlRandom
RtlAreBitsSet
SeValidSecurityDescriptor
ExAllocatePoolWithQuotaTag
ExAcquireFastMutexUnsafe
MmIsDriverVerifying
IoGetDeviceProperty
RtlEnumerateGenericTable
KeInsertQueueDpc
RtlValidSid
IoAllocateErrorLogEntry
MmLockPagableDataSection
RtlSetDaclSecurityDescriptor
IoCreateFile
IoFreeIrp
RtlInitializeUnicodePrefix
SeQueryInformationToken
IoGetDeviceObjectPointer
RtlCharToInteger
SeAssignSecurity
MmUnlockPagableImageSection
FsRtlCheckLockForReadAccess
CcSetBcbOwnerPointer
RtlInt64ToUnicodeString
ProbeForWrite
ExVerifySuite
ExUnregisterCallback
ZwMapViewOfSection
RtlCompareString
IoSetShareAccess
IoGetRequestorProcessId
KeWaitForSingleObject
ZwDeviceIoControlFile
KeRegisterBugCheckCallback
SeDeleteObjectAuditAlarm
RtlSetBits
IoGetBootDiskInformation
CcDeferWrite
MmUnsecureVirtualMemory
ObReferenceObjectByPointer
RtlSecondsSince1980ToTime
SeTokenIsAdmin
ExGetExclusiveWaiterCount
KeQueryTimeIncrement
IoReportResourceForDetection
RtlUpperString
KeRundownQueue
RtlEqualSid
RtlSecondsSince1970ToTime
RtlGUIDFromString
FsRtlNotifyInitializeSync
IoCheckEaBufferValidity
KeRemoveDeviceQueue
FsRtlAllocateFileLock
RtlEqualString
RtlUnicodeToMultiByteN
IoInvalidateDeviceState
SeImpersonateClientEx
KeBugCheck
RtlFindLastBackwardRunClear
IoCreateDevice
RtlFindClearRuns
MmSecureVirtualMemory
ZwQueryVolumeInformationFile
KeRemoveEntryDeviceQueue
FsRtlDeregisterUncProvider
IoGetDriverObjectExtension
RtlCopyLuid
MmMapIoSpace
IoAllocateWorkItem
IoUpdateShareAccess
RtlValidSecurityDescriptor
PoSetSystemState
KePulseEvent
ExDeleteNPagedLookasideList
ZwOpenFile
KeInsertDeviceQueue
IoAttachDeviceToDeviceStack
IoCreateStreamFileObjectLite
MmProbeAndLockPages
IoCreateSymbolicLink
ExInitializeResourceLite
IoRaiseHardError
ExAllocatePoolWithTag
IoCheckShareAccess
PsDereferencePrimaryToken
DbgBreakPointWithStatus
ExGetPreviousMode
RtlNumberOfClearBits
ExIsProcessorFeaturePresent
ZwDeleteKey
RtlEqualUnicodeString
RtlInitializeSid
IoOpenDeviceRegistryKey
KeLeaveCriticalRegion
MmForceSectionClosed
RtlInitUnicodeString
KeBugCheckEx
RtlFindNextForwardRunClear
IoInitializeTimer
ZwEnumerateKey
RtlSetAllBits
CcFastCopyWrite
KeResetEvent
RtlPrefixUnicodeString
ZwOpenSymbolicLinkObject
FsRtlFastUnlockSingle
RtlMapGenericMask
PoCallDriver
ExFreePoolWithTag
IoGetAttachedDevice
PsGetCurrentThread
KeEnterCriticalRegion
ZwQueryInformationFile
IoStopTimer
IoGetAttachedDeviceReference
RtlHashUnicodeString
PoSetPowerState
IoGetDeviceInterfaces
MmPageEntireDriver
ZwOpenKey
PsGetCurrentProcess
ProbeForRead
RtlFillMemoryUlong
KeInitializeQueue
IoSetThreadHardErrorMode
RtlInitAnsiString
IoIsSystemThread
FsRtlFreeFileLock
IoInitializeIrp
KeWaitForMultipleObjects
KeStackAttachProcess
RtlAppendStringToString
ExDeleteResourceLite
RtlDeleteRegistryValue
KeSetTimer
FsRtlIsDbcsInExpression
MmHighestUserAddress
IoFreeController
ZwQueryKey
KeInitializeTimerEx
PoRegisterSystemState
KeInitializeSpinLock
RtlCopyString
IoMakeAssociatedIrp
RtlAnsiStringToUnicodeString
PsLookupThreadByThreadId
ExLocalTimeToSystemTime
IoWriteErrorLogEntry
IoGetStackLimits
KeInsertByKeyDeviceQueue
RtlUpcaseUnicodeToOemN
RtlCreateUnicodeString
ZwEnumerateValueKey
MmQuerySystemSize
KeSetBasePriorityThread
MmFreeContiguousMemory
SeTokenIsRestricted
KeInitializeEvent
KeQueryInterruptTime
KeGetCurrentThread
RtlCopyUnicodeString
RtlCreateRegistryKey
IoGetDeviceToVerify
RtlCheckRegistryKey
KeReadStateEvent
Sections
.text Size: 36KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 342B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 25KB - Virtual size: 51KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ