D:\CrhDupjV\QaesyBQhoaW\vFelJuiow.pdb
Static task
static1
Behavioral task
behavioral1
Sample
dc1f9e4a52f35067710a091b65a944e6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
dc1f9e4a52f35067710a091b65a944e6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dc1f9e4a52f35067710a091b65a944e6_JaffaCakes118
-
Size
61KB
-
MD5
dc1f9e4a52f35067710a091b65a944e6
-
SHA1
7b4fd5aae0460ff151005f61b8549a43a6b62a8f
-
SHA256
b5e1272d44c2a2467082e6e4e6302ff1fad62c31162b6e200087a566b543cb24
-
SHA512
97e84a3e1bcbde7eb75c0c89e000678c50ad34c9dcebdbbcfccfa45fe89b763cdce5415d41bc53426859c0af3ea3d9b4c1a07b68c575a02e0d44df778c9a7eb8
-
SSDEEP
768:p9AdksjXls7F0C8rRIC9AvirbBSuoPApEK/oPnd/JaYjvttbRz4m9b9gY2T17e7o:p9ZsjXskORzuoIOKQPpfvtRgDT1Wcse
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource dc1f9e4a52f35067710a091b65a944e6_JaffaCakes118
Files
-
dc1f9e4a52f35067710a091b65a944e6_JaffaCakes118.dll windows:5 windows x86 arch:x86
7fb06b02802353f0197786709cfc8478
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoIsSystemThread
SeOpenObjectAuditAlarm
RtlInitUnicodeString
ZwOpenFile
KeSetTargetProcessorDpc
RtlEqualUnicodeString
CcSetBcbOwnerPointer
KeRemoveQueue
RtlInitString
RtlCompareString
RtlFindUnicodePrefix
PsIsThreadTerminating
RtlHashUnicodeString
RtlNumberOfClearBits
IoCreateSymbolicLink
IoAllocateErrorLogEntry
KeSetTimerEx
KeRestoreFloatingPointState
FsRtlGetNextFileLock
RtlUnicodeToMultiByteN
_wcsupr
IoBuildPartialMdl
RtlEqualString
IoIsWdmVersionAvailable
IoGetDeviceToVerify
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.file Size: 512B - Virtual size: 459B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.type Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 744B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ