?DeleteFunctionNew@@IJPAFPAK@X
Static task
static1
Behavioral task
behavioral1
Sample
d14549e84bc566f69d32d825f0a26e11_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
d14549e84bc566f69d32d825f0a26e11_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d14549e84bc566f69d32d825f0a26e11_JaffaCakes118
-
Size
181KB
-
MD5
d14549e84bc566f69d32d825f0a26e11
-
SHA1
658bc4ef6ddb15a5a227a545bfaeefea83396278
-
SHA256
b868cde76d1fa67b37e3f5a5fc7c33fad08ece40150fc7407c1c00a3c535b887
-
SHA512
4a585b23d1726dd3d62d5deecf8523bc7f9be35dde9e37735a0960226bd095f3e32edf13c13bc93eade59801c8998d22edbe9765b00ade48a4cfd9eeb576a5af
-
SSDEEP
3072:XfoISpY3D959IcFsN+msn8REcitf0+R3TKEUx41eR:NKU9f8REztfDRDEM
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d14549e84bc566f69d32d825f0a26e11_JaffaCakes118
Files
-
d14549e84bc566f69d32d825f0a26e11_JaffaCakes118.dll windows:5 windows x86 arch:x86
e9182ba84c30d12c19be46b323f712a3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
KeResetEvent
IoGetDmaAdapter
CcUnpinRepinnedBcb
ExRaiseStatus
MmSecureVirtualMemory
ZwCreateFile
IofCallDriver
SeQueryInformationToken
RtlClearAllBits
RtlGetCallersAddress
RtlCopySid
ExAllocatePoolWithQuota
IoFreeErrorLogEntry
ZwQueryVolumeInformationFile
RtlWriteRegistryValue
RtlFillMemoryUlong
IoRegisterDeviceInterface
RtlSecondsSince1970ToTime
KeSaveFloatingPointState
IoAcquireRemoveLockEx
ZwDeleteValueKey
ZwOpenFile
IoCheckQuotaBufferValidity
MmMapIoSpace
PoUnregisterSystemState
ZwEnumerateKey
KeEnterCriticalRegion
KeInitializeDpc
IoSetTopLevelIrp
RtlUnicodeStringToOemString
KeClearEvent
SeTokenIsRestricted
RtlInitString
ExUuidCreate
IoFreeMdl
RtlNumberOfClearBits
MmMapLockedPages
ZwQueryObject
KeRemoveEntryDeviceQueue
CcUnpinData
IoCreateDisk
RtlCreateSecurityDescriptor
ExReleaseResourceLite
MmFreePagesFromMdl
SeAccessCheck
KeSetImportanceDpc
IoAllocateIrp
CcSetFileSizes
ObOpenObjectByPointer
KeInitializeApc
CcMdlReadComplete
RtlGenerate8dot3Name
RtlEqualUnicodeString
IoGetLowerDeviceObject
RtlGUIDFromString
IoRequestDeviceEject
IoStartTimer
PsLookupProcessByProcessId
MmQuerySystemSize
RtlUnicodeToOemN
KeInsertDeviceQueue
RtlHashUnicodeString
ExReinitializeResourceLite
IoReleaseRemoveLockEx
MmAdvanceMdl
PsIsThreadTerminating
MmPageEntireDriver
ZwCreateDirectoryObject
IoGetBootDiskInformation
MmProbeAndLockProcessPages
ExAcquireResourceSharedLite
IoCsqRemoveIrp
IoGetDeviceToVerify
MmCanFileBeTruncated
IoCreateDevice
KeSetSystemAffinityThread
IoFreeWorkItem
CcDeferWrite
IoSetThreadHardErrorMode
RtlFindClearBitsAndSet
IoQueryFileDosDeviceName
KeInitializeSemaphore
SeAssignSecurity
RtlGetNextRange
IoIsOperationSynchronous
IoVerifyVolume
RtlOemToUnicodeN
IoWritePartitionTableEx
RtlValidSid
SePrivilegeCheck
ZwDeleteKey
SeCreateClientSecurity
IoWMIRegistrationControl
RtlCheckRegistryKey
ExLocalTimeToSystemTime
IoReadDiskSignature
ExAllocatePool
FsRtlNotifyInitializeSync
ExDeleteNPagedLookasideList
ZwQueryKey
IoCreateStreamFileObjectLite
RtlUpperChar
IoVolumeDeviceToDosName
CcFastMdlReadWait
RtlAppendStringToString
MmUnmapLockedPages
IoAcquireVpbSpinLock
IoRaiseHardError
MmGetPhysicalAddress
RtlInitializeSid
RtlCompareString
MmUnlockPages
KeSetEvent
IoGetTopLevelIrp
ZwOpenSymbolicLinkObject
RtlSplay
MmHighestUserAddress
IoAllocateAdapterChannel
MmAllocateContiguousMemory
ExNotifyCallback
RtlPrefixUnicodeString
RtlQueryRegistryValues
PsImpersonateClient
RtlCreateUnicodeString
IoSetHardErrorOrVerifyDevice
KdEnableDebugger
PoCallDriver
KeInsertByKeyDeviceQueue
IoGetDriverObjectExtension
MmUnsecureVirtualMemory
IoStartPacket
ZwCreateKey
IoGetCurrentProcess
RtlCreateRegistryKey
IoInitializeIrp
KeInitializeEvent
PoStartNextPowerIrp
SeFreePrivileges
KeBugCheckEx
KeSetBasePriorityThread
RtlUnicodeStringToInteger
IoThreadToProcess
IoGetStackLimits
IoRemoveShareAccess
RtlUpperString
RtlInitializeBitMap
RtlExtendedIntegerMultiply
CcPinRead
IoAcquireCancelSpinLock
KeInsertQueueDpc
ExQueueWorkItem
ZwOpenKey
IoInitializeTimer
IoReuseIrp
PsLookupThreadByThreadId
SeOpenObjectAuditAlarm
RtlAnsiStringToUnicodeString
FsRtlMdlWriteCompleteDev
SeReleaseSubjectContext
ZwAllocateVirtualMemory
ZwLoadDriver
KeInitializeMutex
MmUnlockPagableImageSection
IoOpenDeviceRegistryKey
KeRevertToUserAffinityThread
RtlDeleteElementGenericTable
IoQueryFileInformation
FsRtlIsHpfsDbcsLegal
KeInsertQueue
RtlSecondsSince1980ToTime
KeLeaveCriticalRegion
RtlSetAllBits
SeQueryAuthenticationIdToken
RtlDelete
ExFreePoolWithTag
ZwOpenProcess
KePulseEvent
ObReferenceObjectByPointer
KeReleaseSemaphore
KefAcquireSpinLockAtDpcLevel
ZwQueryValueKey
KeSetTimer
SeFilterToken
ObfDereferenceObject
PsDereferencePrimaryToken
SeDeleteObjectAuditAlarm
RtlFindUnicodePrefix
IoStopTimer
RtlAddAccessAllowedAceEx
KdDisableDebugger
IoBuildSynchronousFsdRequest
PsRevertToSelf
HalExamineMBR
KeRemoveByKeyDeviceQueue
MmMapUserAddressesToPage
RtlGetVersion
IoGetDeviceInterfaceAlias
RtlTimeToSecondsSince1980
IoReadPartitionTableEx
RtlDowncaseUnicodeString
RtlIsNameLegalDOS8Dot3
KeInitializeDeviceQueue
IoDeviceObjectType
ExRegisterCallback
PsReferencePrimaryToken
RtlAddAccessAllowedAce
DbgPrompt
CcZeroData
PsGetCurrentProcessId
ObReferenceObjectByHandle
RtlInt64ToUnicodeString
SeUnlockSubjectContext
PoSetSystemState
IoCheckShareAccess
ObfReferenceObject
PsCreateSystemThread
PsReturnPoolQuota
RtlEnumerateGenericTable
KeSetKernelStackSwapEnable
IoReleaseVpbSpinLock
RtlInsertUnicodePrefix
RtlStringFromGUID
IoSetPartitionInformationEx
KeQueryTimeIncrement
IoAllocateErrorLogEntry
IoFreeIrp
KeDetachProcess
ZwFreeVirtualMemory
ExIsProcessorFeaturePresent
RtlTimeFieldsToTime
ProbeForWrite
MmFreeContiguousMemory
ExSetResourceOwnerPointer
MmLockPagableDataSection
RtlFreeAnsiString
KeReadStateMutex
ExSystemTimeToLocalTime
MmForceSectionClosed
MmFreeNonCachedMemory
KeGetCurrentThread
IoIsWdmVersionAvailable
RtlFindClearRuns
CcMapData
FsRtlIsTotalDeviceFailure
RtlUnicodeToMultiByteN
FsRtlFastUnlockSingle
MmResetDriverPaging
SeValidSecurityDescriptor
SeSetSecurityDescriptorInfo
ObInsertObject
FsRtlGetNextFileLock
KeTickCount
ObGetObjectSecurity
IoWriteErrorLogEntry
IoCreateStreamFileObject
RtlSubAuthoritySid
SeCaptureSubjectContext
RtlFreeOemString
FsRtlDeregisterUncProvider
PsGetCurrentProcess
KeRundownQueue
CcIsThereDirtyData
RtlUnicodeStringToAnsiString
KeSetPriorityThread
Exports
Exports
Sections
.text Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 676B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ