X:\eqkWrrvAuwhT\qhcdKgxazvgng\asxbYbzp.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ce08fac8d0cb95e57943477f773a6a87_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ce08fac8d0cb95e57943477f773a6a87_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ce08fac8d0cb95e57943477f773a6a87_JaffaCakes118
-
Size
37KB
-
MD5
ce08fac8d0cb95e57943477f773a6a87
-
SHA1
7cb4b70233dbaa33b716d5d463af7874949dde35
-
SHA256
04bd42f84b8c2b23003da26d2d86b73ffe43ca04ea7d65afac0177f920c9a2f4
-
SHA512
0f187d388f3507dbb20a03f0b29ccafb97ac6018fdef026bf92c4d8648b4ffc5aa22daaaba33c20495ac31a5837dbb0fae6f165831e30e5727fabfee534e484a
-
SSDEEP
768:UFsOqGlwfjL/yiZaBUF4SMRATtbs8+8LQwn4T4t:UFlqhfjL/yi862SMRABg8l4T4t
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ce08fac8d0cb95e57943477f773a6a87_JaffaCakes118
Files
-
ce08fac8d0cb95e57943477f773a6a87_JaffaCakes118.dll windows:5 windows x86 arch:x86
a636f11905ad62c82adfa1944a011712
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlClearAllBits
IoAllocateErrorLogEntry
IoReuseIrp
IoGetDiskDeviceObject
RtlDeleteElementGenericTable
RtlAnsiStringToUnicodeString
MmIsThisAnNtAsSystem
IoSetStartIoAttributes
KeSaveFloatingPointState
IoCreateFile
IoCreateNotificationEvent
RtlUpcaseUnicodeToOemN
KeInsertHeadQueue
RtlxOemStringToUnicodeSize
RtlExtendedIntegerMultiply
IoCheckShareAccess
RtlAddAccessAllowedAce
CcZeroData
ExInitializeResourceLite
RtlUnicodeToOemN
KeRestoreFloatingPointState
FsRtlFastCheckLockForRead
RtlCopySid
IoEnumerateDeviceObjectList
ZwCreateFile
SeOpenObjectAuditAlarm
RtlTimeToSecondsSince1970
ZwFsControlFile
MmHighestUserAddress
MmResetDriverPaging
KeRevertToUserAffinityThread
KeRundownQueue
RtlCreateRegistryKey
IoQueryFileInformation
SePrivilegeCheck
ZwClose
IofCallDriver
ExSetTimerResolution
RtlCreateSecurityDescriptor
IoSetHardErrorOrVerifyDevice
KeRegisterBugCheckCallback
RtlClearBits
KeDetachProcess
MmLockPagableSectionByHandle
RtlQueryRegistryValues
KeSetTimer
ExRaiseAccessViolation
ObReferenceObjectByHandle
IoBuildSynchronousFsdRequest
ExSystemTimeToLocalTime
ProbeForWrite
MmMapLockedPages
ExQueueWorkItem
KeClearEvent
RtlGetVersion
MmBuildMdlForNonPagedPool
ZwDeleteValueKey
KeReadStateSemaphore
RtlDelete
RtlCheckRegistryKey
ZwCreateKey
RtlFreeOemString
RtlAreBitsClear
RtlSecondsSince1980ToTime
ExGetPreviousMode
ZwOpenKey
ExFreePoolWithTag
ZwDeleteKey
CcFlushCache
PoUnregisterSystemState
IoCreateSynchronizationEvent
RtlUnicodeStringToInteger
IoInitializeIrp
PsSetLoadImageNotifyRoutine
KeStackAttachProcess
IoReportResourceForDetection
IoGetLowerDeviceObject
KeUnstackDetachProcess
ZwOpenSection
RtlVolumeDeviceToDosName
RtlMapGenericMask
IoGetAttachedDevice
RtlGetNextRange
ExDeleteNPagedLookasideList
RtlInitString
RtlInitializeUnicodePrefix
KeInitializeSpinLock
CcCanIWrite
RtlCopyLuid
SeFreePrivileges
MmLockPagableDataSection
ZwOpenProcess
MmSetAddressRangeModified
DbgBreakPoint
MmIsVerifierEnabled
RtlSetBits
RtlUpcaseUnicodeChar
ExAllocatePoolWithQuotaTag
PsChargeProcessPoolQuota
CcIsThereDirtyData
HalExamineMBR
FsRtlNotifyInitializeSync
ExIsProcessorFeaturePresent
PsTerminateSystemThread
KeResetEvent
CcMapData
MmFlushImageSection
IoSetShareAccess
CcSetReadAheadGranularity
RtlFindLongestRunClear
CcInitializeCacheMap
WmiQueryTraceInformation
FsRtlDeregisterUncProvider
IoConnectInterrupt
IoIsWdmVersionAvailable
IoGetDeviceInterfaceAlias
IoGetCurrentProcess
PoRegisterSystemState
FsRtlIsFatDbcsLegal
MmAllocatePagesForMdl
RtlValidSecurityDescriptor
CcUnpinDataForThread
IoStartPacket
MmUnmapReservedMapping
ZwDeviceIoControlFile
ZwQueryObject
RtlDeleteNoSplay
KeReleaseSemaphore
CcGetFileObjectFromBcb
KeSetBasePriorityThread
MmUnsecureVirtualMemory
KeInitializeDeviceQueue
KeSetTimerEx
PsLookupThreadByThreadId
ExAllocatePoolWithTag
RtlDeleteRegistryValue
CcRemapBcb
ZwNotifyChangeKey
IoReadDiskSignature
KefAcquireSpinLockAtDpcLevel
RtlLengthSecurityDescriptor
IoAcquireCancelSpinLock
RtlUpperChar
RtlPrefixUnicodeString
KeInitializeMutex
MmGetSystemRoutineAddress
RtlFillMemoryUlong
MmSecureVirtualMemory
CcMdlWriteAbort
ExReleaseResourceLite
KeRemoveDeviceQueue
IoGetDeviceProperty
PsReturnPoolQuota
IoCheckQuotaBufferValidity
RtlUpcaseUnicodeString
RtlSplay
MmFreePagesFromMdl
KdEnableDebugger
CcSetBcbOwnerPointer
ExGetExclusiveWaiterCount
IoDisconnectInterrupt
CcCopyWrite
RtlInitializeSid
ExAllocatePool
MmFreeContiguousMemory
PoRequestPowerIrp
ZwQueryKey
KeRemoveQueueDpc
MmGetPhysicalAddress
ZwQueryInformationFile
ZwSetSecurityObject
CcFastCopyWrite
KeQueryTimeIncrement
KeSetTargetProcessorDpc
IoGetDeviceObjectPointer
IoIsSystemThread
SeCreateClientSecurity
FsRtlCheckLockForReadAccess
KeSynchronizeExecution
IoReleaseCancelSpinLock
CcPreparePinWrite
FsRtlIsNameInExpression
MmIsDriverVerifying
IofCompleteRequest
PoSetPowerState
ZwSetValueKey
IoThreadToProcess
CcMdlRead
FsRtlIsDbcsInExpression
KeInitializeApc
CcPurgeCacheSection
ObMakeTemporaryObject
KeQuerySystemTime
SeDeleteObjectAuditAlarm
RtlFindNextForwardRunClear
IoVerifyPartitionTable
RtlInitializeBitMap
IoCsqRemoveIrp
RtlGenerate8dot3Name
IoAcquireRemoveLockEx
IoGetRelatedDeviceObject
IoInitializeTimer
IoAllocateController
RtlInsertUnicodePrefix
MmMapUserAddressesToPage
KeInsertQueue
RtlGetCallersAddress
ExAcquireFastMutexUnsafe
KeWaitForMultipleObjects
RtlxAnsiStringToUnicodeSize
RtlEqualUnicodeString
IoReleaseVpbSpinLock
IoQueryFileDosDeviceName
ObGetObjectSecurity
ZwEnumerateKey
RtlIntegerToUnicodeString
RtlDowncaseUnicodeString
KeRemoveByKeyDeviceQueue
IoVolumeDeviceToDosName
ZwOpenFile
IoDetachDevice
KeReadStateEvent
VerSetConditionMask
IoFreeErrorLogEntry
IoBuildPartialMdl
ObReferenceObjectByPointer
MmAllocateContiguousMemory
ZwOpenSymbolicLinkObject
MmCanFileBeTruncated
ExCreateCallback
SeValidSecurityDescriptor
MmMapIoSpace
CcFastMdlReadWait
IoGetDeviceInterfaces
IoQueryDeviceDescription
ZwSetVolumeInformationFile
KeInitializeSemaphore
RtlAnsiCharToUnicodeChar
KeSetKernelStackSwapEnable
SeAppendPrivileges
IoReleaseRemoveLockEx
IoGetBootDiskInformation
IoGetAttachedDeviceReference
MmPageEntireDriver
ZwCreateSection
ExAcquireResourceSharedLite
RtlCompareString
RtlNumberOfClearBits
MmFreeNonCachedMemory
RtlCopyUnicodeString
ZwUnloadDriver
CcMdlReadComplete
FsRtlNotifyUninitializeSync
FsRtlFreeFileLock
RtlInt64ToUnicodeString
Sections
.text Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.t_i Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t_e Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.t_p Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 1024B - Virtual size: 849B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 572B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ