S:\imsu\npjqa\dpuSxXd.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d59a880862806df495cd7e56d1911f8d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
d59a880862806df495cd7e56d1911f8d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d59a880862806df495cd7e56d1911f8d_JaffaCakes118
-
Size
38KB
-
MD5
d59a880862806df495cd7e56d1911f8d
-
SHA1
ba7b9102d580c465915cca2049ffcbc1316ac458
-
SHA256
43fd554b0e119c5500a82fd719df576c194805cf3fb5fc647bb8dcb7d92b1293
-
SHA512
30e2a706b3816d42f3e330abbb1781648080aeee85c04fdc3acdb481eada8027e5381df85a402e6c66889f6bea6d9a3568e2c75a6b5ffcb8a780efe31b67174f
-
SSDEEP
384:+03SNMnzt9y+m54odLPfMQ1L7Wc0stbzsKa42Cba/68aFT5dsywoMYH:+0i6voQQ1LVXaBGE6z31ws
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d59a880862806df495cd7e56d1911f8d_JaffaCakes118
Files
-
d59a880862806df495cd7e56d1911f8d_JaffaCakes118.dll windows:5 windows x86 arch:x86
bd37343bbaeb864dc273d9e6d7efef98
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
PsLookupProcessByProcessId
ExIsProcessorFeaturePresent
RtlLengthRequiredSid
SeValidSecurityDescriptor
MmResetDriverPaging
KeReadStateTimer
IoIsWdmVersionAvailable
RtlInitAnsiString
PsGetCurrentProcess
ExRaiseDatatypeMisalignment
ZwCreateKey
IoCheckShareAccess
FsRtlIsHpfsDbcsLegal
ExGetExclusiveWaiterCount
KeInitializeTimerEx
RtlOemStringToUnicodeString
FsRtlSplitLargeMcb
KeRestoreFloatingPointState
RtlEnumerateGenericTable
MmMapLockedPagesSpecifyCache
RtlNtStatusToDosError
IoDeleteController
ExRaiseAccessViolation
RtlUnicodeStringToInteger
ZwDeleteKey
ExRaiseStatus
PsIsThreadTerminating
RtlInsertUnicodePrefix
Exports
Exports
?ijQXcBsWYuuBdtzsak@@YGHG@Z
?wcOpyfmFXnkzGglaxH@@YGIIPAF@Z
?qpTKbYjylCalncyd@@YGPAKJN@Z
?DivimZaBlnT@@YG_NED@Z
?guoyfnpep@@YGME@Z
?qfTxSwwFzeTdpKoNPofvEg@@YGJFPAD@Z
?gJlfgShc@@YGKPAIPAN@Z
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 315B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ