S:\iIoPvgg\IldsqwlwBgZPro\lyvZBBvA\wycyqpvhvXxvGA.pdb
Static task
static1
Behavioral task
behavioral1
Sample
c08563d8950342712dff1680c0a6f393_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c08563d8950342712dff1680c0a6f393_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c08563d8950342712dff1680c0a6f393_JaffaCakes118
-
Size
159KB
-
MD5
c08563d8950342712dff1680c0a6f393
-
SHA1
2cab98e7b908c27defac28bec94e5e5dd1206d76
-
SHA256
e8f6db1ecc6e14c71ab1fbf20b07845736a56b64623590a5088194167e560772
-
SHA512
2b7d16bf712eced24ce0f02f3ddfadcd1d21602e6c8a05d42f63d7e48c18b15a2e612ec942d6627415b498662d2433b38561ce19938bf3b54cff339fa4dccec7
-
SSDEEP
3072:88e1NFZsndK7GtBnaOA1D6c2FfL26HQnZ3gXk23s5Pa+jB3fwLEx:Iun87+VatL2FfL3yJaU3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c08563d8950342712dff1680c0a6f393_JaffaCakes118
Files
-
c08563d8950342712dff1680c0a6f393_JaffaCakes118.dll windows:5 windows x86 arch:x86
94c4880d4988a84c767052877e6f2e6d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
KeSaveFloatingPointState
RtlCheckRegistryKey
MmBuildMdlForNonPagedPool
RtlValidSecurityDescriptor
SeDeassignSecurity
SeQueryAuthenticationIdToken
RtlUnicodeStringToInteger
IoAllocateWorkItem
RtlMultiByteToUnicodeN
IoReportResourceForDetection
RtlDeleteRegistryValue
IoGetDeviceProperty
RtlEqualSid
RtlCreateSecurityDescriptor
IoBuildSynchronousFsdRequest
RtlQueryRegistryValues
RtlAreBitsSet
IoStartNextPacket
KeInitializeSemaphore
KdEnableDebugger
ZwEnumerateValueKey
RtlCopyString
ExCreateCallback
RtlValidSid
IoGetRequestorProcessId
KeClearEvent
IoDeleteController
ExReleaseFastMutexUnsafe
ExSetTimerResolution
IoGetDeviceInterfaces
IoCreateSymbolicLink
PoRegisterSystemState
IoQueueWorkItem
ZwQueryValueKey
FsRtlCheckLockForReadAccess
ExDeleteNPagedLookasideList
CcSetBcbOwnerPointer
RtlClearAllBits
IoOpenDeviceRegistryKey
KeSynchronizeExecution
ExRaiseDatatypeMisalignment
ExRegisterCallback
SeSinglePrivilegeCheck
FsRtlDeregisterUncProvider
ExVerifySuite
RtlUnicodeToMultiByteN
ExNotifyCallback
PoRequestPowerIrp
CcZeroData
ObGetObjectSecurity
PsGetCurrentProcessId
SeValidSecurityDescriptor
KeRundownQueue
IoReuseIrp
ExAcquireResourceSharedLite
IoGetBootDiskInformation
RtlFindClearBits
RtlInitializeBitMap
RtlInitializeGenericTable
CcFastCopyRead
RtlCreateUnicodeString
MmSetAddressRangeModified
RtlCompareMemory
KeInitializeApc
KeReadStateEvent
ExDeletePagedLookasideList
RtlSubAuthoritySid
PsCreateSystemThread
RtlVerifyVersionInfo
RtlFindMostSignificantBit
IoSetDeviceInterfaceState
KeInitializeQueue
RtlFindClearRuns
ZwMakeTemporaryObject
KeFlushQueuedDpcs
KeCancelTimer
KeRestoreFloatingPointState
MmSizeOfMdl
IoInitializeIrp
RtlUpperString
CcUnpinDataForThread
MmGetSystemRoutineAddress
KeWaitForMultipleObjects
RtlGetNextRange
RtlSetBits
FsRtlIsTotalDeviceFailure
FsRtlIsNameInExpression
RtlCopyLuid
IoFreeWorkItem
IoSetHardErrorOrVerifyDevice
RtlFindUnicodePrefix
FsRtlGetNextFileLock
IoCheckEaBufferValidity
IoCreateNotificationEvent
RtlDeleteNoSplay
RtlRemoveUnicodePrefix
KeReadStateMutex
ExSetResourceOwnerPointer
KeInsertQueueDpc
MmQuerySystemSize
ExGetPreviousMode
IoInvalidateDeviceRelations
CcFastCopyWrite
SeTokenIsRestricted
IoGetDeviceToVerify
IoInitializeTimer
RtlFindClearBitsAndSet
KeSetKernelStackSwapEnable
KeDelayExecutionThread
ExReleaseResourceLite
RtlAnsiStringToUnicodeString
IoAttachDeviceToDeviceStack
RtlCharToInteger
FsRtlSplitLargeMcb
ExGetSharedWaiterCount
RtlUpcaseUnicodeChar
KeQuerySystemTime
SeQueryInformationToken
RtlTimeFieldsToTime
KeUnstackDetachProcess
RtlMapGenericMask
CcIsThereDirtyData
CcRemapBcb
ExRaiseStatus
FsRtlAllocateFileLock
KeSetTimerEx
ZwClose
SeAssignSecurity
FsRtlIsFatDbcsLegal
MmUnlockPagableImageSection
DbgBreakPointWithStatus
RtlUnicodeToOemN
FsRtlIsHpfsDbcsLegal
IoUpdateShareAccess
MmMapIoSpace
FsRtlNotifyInitializeSync
IoAllocateController
IoCancelIrp
KeReleaseSemaphore
RtlTimeToSecondsSince1980
MmIsAddressValid
RtlInitializeSid
IoFreeController
RtlSecondsSince1980ToTime
KdDisableDebugger
RtlSecondsSince1970ToTime
ZwOpenSymbolicLinkObject
KeSetPriorityThread
KeRemoveQueue
RtlLengthSecurityDescriptor
IoMakeAssociatedIrp
KeRemoveDeviceQueue
RtlOemStringToUnicodeString
RtlAppendStringToString
FsRtlIsDbcsInExpression
IoDeviceObjectType
MmAllocateContiguousMemory
PsLookupThreadByThreadId
RtlUpperChar
KeGetCurrentThread
CcDeferWrite
KeSetTimer
RtlClearBits
RtlCopySid
MmCanFileBeTruncated
IoSetThreadHardErrorMode
RtlxUnicodeStringToAnsiSize
MmHighestUserAddress
KeInitializeEvent
RtlInitString
RtlUpcaseUnicodeToOemN
IoStartTimer
PsGetCurrentThreadId
MmGetPhysicalAddress
ZwCreateFile
SeAccessCheck
ObQueryNameString
IoGetStackLimits
MmUnmapLockedPages
RtlNumberOfClearBits
RtlNtStatusToDosError
PoSetPowerState
KeRemoveEntryDeviceQueue
IoRemoveShareAccess
IoRaiseHardError
ZwDeviceIoControlFile
ZwCreateSection
IoRequestDeviceEject
IoCheckShareAccess
RtlHashUnicodeString
KeInsertQueue
FsRtlCheckOplock
ZwQueryVolumeInformationFile
ObCreateObject
IoDeleteDevice
IoCreateFile
KeSetImportanceDpc
ExUnregisterCallback
KeInsertHeadQueue
RtlUnicodeStringToAnsiString
KeDeregisterBugCheckCallback
ExLocalTimeToSystemTime
IoReportDetectedDevice
ZwOpenFile
FsRtlCheckLockForWriteAccess
RtlCompareString
RtlLengthRequiredSid
MmLockPagableDataSection
ZwCreateKey
RtlWriteRegistryValue
CcFastMdlReadWait
CcCopyRead
MmResetDriverPaging
KeBugCheckEx
IoFreeIrp
RtlTimeToTimeFields
KeRegisterBugCheckCallback
FsRtlLookupLastLargeMcbEntry
ZwFreeVirtualMemory
ZwQuerySymbolicLinkObject
IoInvalidateDeviceState
RtlInitAnsiString
KeSetBasePriorityThread
ZwEnumerateKey
PsLookupProcessByProcessId
IoIsWdmVersionAvailable
SeImpersonateClientEx
KeReadStateTimer
ZwQueryObject
ExRaiseAccessViolation
MmFreeNonCachedMemory
RtlFillMemoryUlong
MmSecureVirtualMemory
RtlSetDaclSecurityDescriptor
IoSetSystemPartition
IoBuildPartialMdl
ZwAllocateVirtualMemory
RtlGetVersion
RtlFindSetBits
ExSystemTimeToLocalTime
RtlGUIDFromString
RtlInt64ToUnicodeString
RtlAreBitsClear
RtlFreeAnsiString
RtlInitUnicodeString
ZwOpenKey
KeQueryInterruptTime
IoAllocateIrp
SeDeleteObjectAuditAlarm
KeQueryActiveProcessors
ZwMapViewOfSection
ZwQueryKey
PsGetCurrentThread
ExAllocatePoolWithTag
IoGetAttachedDeviceReference
RtlFindLeastSignificantBit
RtlSetAllBits
KeInitializeTimerEx
Sections
.text Size: 37KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_txt Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_txt Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele3 Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele1 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tele2 Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tele4 Size: 512B - Virtual size: 420B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 672B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ