R:\hxdginletczd\gaavyqbynzvi\rtzjonvhcQMA\sYccFHeGfXe\HfOtmFyCRgt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
cdfc17f6bd19017544324a7905be9e6f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
cdfc17f6bd19017544324a7905be9e6f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cdfc17f6bd19017544324a7905be9e6f_JaffaCakes118
-
Size
64KB
-
MD5
cdfc17f6bd19017544324a7905be9e6f
-
SHA1
a698053770a3f3c2ae95cc0f4333ea3e9712a00b
-
SHA256
62a3c21f4deead24915dc5a991b77c6eb52104a71cec46671dab5346de007a29
-
SHA512
ade7e3e04c7b6a8c89d288e23e193e179a3a21f4d3b28ba9cea54568eb7163115abf6908feb9121e81212031d5a119009932e7fd95c5ff656921a31fe45323d9
-
SSDEEP
1536:uenS3SvkXH+DfAJnlaqG4+LZ/HwubVCJcz3/:jhvKH8If/+hH9VUcz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cdfc17f6bd19017544324a7905be9e6f_JaffaCakes118
Files
-
cdfc17f6bd19017544324a7905be9e6f_JaffaCakes118.dll windows:5 windows x86 arch:x86
3856e5305768ca79725552f5be198036
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlCopyUnicodeString
RtlSetBits
RtlEqualUnicodeString
KeRevertToUserAffinityThread
FsRtlSplitLargeMcb
RtlFreeOemString
ExUuidCreate
KeSetTimer
RtlInsertUnicodePrefix
IoCreateSymbolicLink
IoGetAttachedDeviceReference
RtlFindClearBitsAndSet
IoAllocateAdapterChannel
IoReleaseRemoveLockEx
IoWritePartitionTableEx
FsRtlCheckLockForReadAccess
PsGetCurrentProcessId
RtlxOemStringToUnicodeSize
MmProbeAndLockProcessPages
ZwCreateDirectoryObject
PoRegisterSystemState
ObOpenObjectByPointer
MmIsVerifierEnabled
FsRtlFastCheckLockForRead
ExFreePoolWithTag
CcFastCopyRead
ExReleaseFastMutexUnsafe
CcInitializeCacheMap
CcMdlReadComplete
SeQueryAuthenticationIdToken
MmMapUserAddressesToPage
IoConnectInterrupt
RtlGUIDFromString
SeSetSecurityDescriptorInfo
ObfDereferenceObject
RtlGetNextRange
MmIsDriverVerifying
ZwDeleteKey
CcFastMdlReadWait
KeInsertByKeyDeviceQueue
ExGetSharedWaiterCount
RtlRemoveUnicodePrefix
ZwQueryObject
IoCheckEaBufferValidity
SeCaptureSubjectContext
KeRemoveQueueDpc
KeInsertQueueDpc
IoAcquireVpbSpinLock
ExRaiseAccessViolation
KeRestoreFloatingPointState
KeClearEvent
ExAllocatePoolWithTag
ZwCreateKey
RtlUnicodeToMultiByteN
SeTokenIsAdmin
RtlMapGenericMask
IoStopTimer
IoFreeErrorLogEntry
MmBuildMdlForNonPagedPool
ZwQuerySymbolicLinkObject
PsGetProcessId
ZwOpenProcess
PsCreateSystemThread
IoVolumeDeviceToDosName
PsChargeProcessPoolQuota
KeSetPriorityThread
RtlLengthSid
IoCancelIrp
IoCreateDisk
ExQueueWorkItem
DbgPrompt
IoEnumerateDeviceObjectList
KeSetSystemAffinityThread
IoReadPartitionTable
RtlInitAnsiString
RtlOemToUnicodeN
RtlCopyString
CcDeferWrite
IoIsSystemThread
RtlAnsiCharToUnicodeChar
ExDeleteNPagedLookasideList
MmForceSectionClosed
ZwReadFile
IoWMIWriteEvent
ObGetObjectSecurity
RtlUpcaseUnicodeToOemN
KeInitializeDeviceQueue
IoCreateNotificationEvent
ObReleaseObjectSecurity
KdDisableDebugger
KeInitializeDpc
IoAcquireCancelSpinLock
KeInitializeApc
ZwQueryValueKey
ExReleaseResourceLite
ZwQueryVolumeInformationFile
IoDeleteSymbolicLink
RtlClearBits
MmAllocateContiguousMemory
RtlGenerate8dot3Name
MmUnlockPages
RtlCreateRegistryKey
ExVerifySuite
IoSetStartIoAttributes
RtlDelete
RtlTimeToSecondsSince1980
KeSetTargetProcessorDpc
ExUnregisterCallback
MmSetAddressRangeModified
IoCheckShareAccess
RtlInitializeBitMap
IoGetRequestorProcess
ExIsProcessorFeaturePresent
MmFreeMappingAddress
IoReuseIrp
CcPreparePinWrite
PsRevertToSelf
RtlEqualString
ZwQueryInformationFile
IoSetDeviceInterfaceState
FsRtlIsNameInExpression
MmPageEntireDriver
MmQuerySystemSize
RtlFindUnicodePrefix
RtlNumberOfClearBits
SeAccessCheck
IoSetPartitionInformation
CcMdlWriteComplete
RtlInitUnicodeString
ExReinitializeResourceLite
MmSizeOfMdl
CcPurgeCacheSection
IoSetHardErrorOrVerifyDevice
ObReferenceObjectByPointer
RtlAddAccessAllowedAce
IoInvalidateDeviceState
MmUnlockPagableImageSection
KeBugCheck
PsTerminateSystemThread
IoGetBootDiskInformation
IoRaiseHardError
ExDeletePagedLookasideList
IoAllocateController
RtlFindSetBits
CcIsThereDirtyData
IoGetDeviceObjectPointer
ExRaiseStatus
RtlEqualSid
KeEnterCriticalRegion
PsImpersonateClient
IoDeviceObjectType
PsLookupThreadByThreadId
KePulseEvent
RtlLengthRequiredSid
KeReadStateSemaphore
IoGetTopLevelIrp
KeInitializeQueue
ZwOpenKey
IoGetDeviceToVerify
SeAssignSecurity
IoCsqRemoveIrp
IoVerifyPartitionTable
KeDetachProcess
KeDeregisterBugCheckCallback
KeRemoveByKeyDeviceQueue
RtlCopyLuid
MmUnsecureVirtualMemory
IoStartTimer
ExAcquireFastMutexUnsafe
KeResetEvent
SeReleaseSubjectContext
RtlDeleteElementGenericTable
KeRundownQueue
RtlGetVersion
SeFreePrivileges
KeBugCheckEx
ZwOpenSection
KeSynchronizeExecution
IoRequestDeviceEject
IoFreeWorkItem
SePrivilegeCheck
IoWriteErrorLogEntry
ZwCreateSection
RtlFreeUnicodeString
KeSetTimerEx
IoQueryDeviceDescription
IoCreateStreamFileObjectLite
PsSetLoadImageNotifyRoutine
IoReportResourceForDetection
KeWaitForSingleObject
PoSetPowerState
WmiQueryTraceInformation
IoGetDriverObjectExtension
PsGetProcessExitTime
DbgBreakPoint
KefAcquireSpinLockAtDpcLevel
RtlCopySid
RtlFindLongestRunClear
CcMapData
RtlSetDaclSecurityDescriptor
RtlInitializeSid
MmMapIoSpace
KeInitializeSpinLock
ExFreePool
IoAllocateErrorLogEntry
PsGetCurrentThread
RtlDowncaseUnicodeString
ExSystemTimeToLocalTime
CcFlushCache
KeUnstackDetachProcess
IoSetThreadHardErrorMode
IoGetDeviceAttachmentBaseRef
RtlCreateSecurityDescriptor
RtlOemStringToUnicodeString
IoThreadToProcess
RtlFindNextForwardRunClear
ExAllocatePoolWithQuotaTag
RtlSubAuthoritySid
FsRtlIsTotalDeviceFailure
KeInitializeSemaphore
KeInitializeTimerEx
ZwFsControlFile
MmAllocatePagesForMdl
IoGetDeviceInterfaces
ZwFreeVirtualMemory
MmGetPhysicalAddress
MmAddVerifierThunks
RtlHashUnicodeString
VerSetConditionMask
CcSetBcbOwnerPointer
RtlAppendUnicodeToString
RtlUpperString
ZwSetSecurityObject
KeSetKernelStackSwapEnable
ZwSetVolumeInformationFile
MmUnmapLockedPages
RtlTimeToTimeFields
KeInsertHeadQueue
RtlCompareString
ObfReferenceObject
KdEnableDebugger
KeReleaseMutex
KeQueryActiveProcessors
ZwQueryKey
ExLocalTimeToSystemTime
RtlCompareMemory
RtlClearAllBits
IoRegisterFileSystem
KeSetBasePriorityThread
RtlFindClearRuns
RtlAreBitsClear
MmMapLockedPagesSpecifyCache
CcUnpinData
RtlSplay
KeRemoveEntryDeviceQueue
IoCreateDevice
RtlAppendStringToString
IoGetDmaAdapter
IoGetCurrentProcess
ZwPowerInformation
Exports
Exports
?CallDataNew@@YGMF~U
?CallProjectNew@@YGMMKPAK~U
?KillFolderPathExA@@YGPA_NPAFFK~U
?RemoveProjectOld@@YGPAHPAE~U
?IncrementVersion@@YGIPAIPAG~U
?CallPathA@@YGFE~U
?RtlSizeOriginal@@YGPAXPAGPAKFPAI~U
?IsValidSectionExW@@YGHPAMK~U
?ValidateListItem@@YGHPAH~U
?IncrementEventEx@@YGEJEPAI~U
?SendPathEx@@YGEPAMPAE~U
?CancelMemoryOriginal@@YGXIPAHPAH~U
?LoadProfileNew@@YGPAXPAHIM~U
?FindData@@YGHPAM_NPAI~U
?ArgumentNew@@YGPAIJDPA_NG~U
?EnumFunctionOld@@YGXJ~U
?KillTimeExW@@YGMPAE~U
?DeleteDeviceExA@@YGKPAIGND~U
?IsConfigNew@@YGJEG~U
?IsDirectoryExW@@YGIPAMD~U
?IsValidTaskEx@@YGIPAGGPAI~U
?CloseModuleW@@YGEPAHE~U
?AppNameA@@YGPAJPANPAJ~U
?CrtModuleW@@YGEIJ~U
?FindDialogExW@@YGPAIE~U
?ProjectEx@@YGXJ~U
?IsNotArgumentNew@@YGXE~U
?IsValidProcessW@@YGFG~U
?ValidateMessageA@@YGPAX_NGG~U
?CrtListExA@@YGPAFPAF~U
?AddHeaderExA@@YGPAXI~U
?ModifyPathA@@YGMPAI~U
?EnumCommandLineExA@@YGGE~U
?InvalidateSizeEx@@YGPAMDJF~U
?DecrementProfileOriginal@@YGPAIJG~U
?LoadDialog@@YGPAGJ~U
Sections
.text Size: 29KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 1024B - Virtual size: 709B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ