?RemoveFolderPathOriginal@@IJPAXPAFPAMH@X
Static task
static1
Behavioral task
behavioral1
Sample
fd49ca7782eca294fecaaef8a31f9544_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd49ca7782eca294fecaaef8a31f9544_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fd49ca7782eca294fecaaef8a31f9544_JaffaCakes118
-
Size
76KB
-
MD5
fd49ca7782eca294fecaaef8a31f9544
-
SHA1
fad4016b580e4b448abfa138873f917fc133eb8b
-
SHA256
4665eb85d3ea691bcfe3755ebe0771ba1a641e07e96a99cf0f58a846d61ee700
-
SHA512
c3875be84ac43a7650ced2068befa3f51620b538367d656f898778e71e99720bffd52d8d706552f0df9bacaafe64f3fd9a356d0c2b2c3141001372fa10930a39
-
SSDEEP
1536:HybKxZbggyTRnfEtS6QSx9bD5MWKrCSSMvalt1R:HyOLbgggsPQSHbDGVrCSRilt1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fd49ca7782eca294fecaaef8a31f9544_JaffaCakes118
Files
-
fd49ca7782eca294fecaaef8a31f9544_JaffaCakes118.dll windows:5 windows x86 arch:x86
e4d55b931f999d3aeeab0458e13dac13
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
ntoskrnl.exe
RtlFindClearBits
PsGetThreadProcessId
RtlFreeAnsiString
RtlxOemStringToUnicodeSize
MmLockPagableDataSection
ObGetObjectSecurity
SeAccessCheck
IoReleaseVpbSpinLock
ProbeForWrite
ExDeleteNPagedLookasideList
MmUnsecureVirtualMemory
SeOpenObjectAuditAlarm
IoVerifyVolume
KeSaveFloatingPointState
SeAssignSecurity
RtlRandom
IoUpdateShareAccess
CcUnpinDataForThread
RtlDeleteNoSplay
ZwPowerInformation
IoGetDeviceToVerify
RtlUpcaseUnicodeToOemN
RtlInitUnicodeString
ExCreateCallback
ExVerifySuite
RtlUnicodeStringToOemString
RtlFillMemoryUlong
ObReleaseObjectSecurity
ObQueryNameString
MmCanFileBeTruncated
MmGetPhysicalAddress
FsRtlIsFatDbcsLegal
IoAcquireRemoveLockEx
WmiQueryTraceInformation
MmMapUserAddressesToPage
RtlGUIDFromString
RtlAreBitsClear
KePulseEvent
RtlDeleteRegistryValue
ZwOpenFile
KeLeaveCriticalRegion
RtlCreateRegistryKey
CcMdlReadComplete
RtlUpcaseUnicodeChar
IoIsWdmVersionAvailable
IoCreateDevice
MmAllocateMappingAddress
KeRundownQueue
ExAllocatePoolWithQuotaTag
MmIsAddressValid
ZwSetSecurityObject
IoVolumeDeviceToDosName
IoGetAttachedDevice
ZwQuerySymbolicLinkObject
IoSetPartitionInformation
IoUnregisterFileSystem
IoBuildSynchronousFsdRequest
ExSystemTimeToLocalTime
RtlFreeUnicodeString
IoCheckShareAccess
MmIsDriverVerifying
RtlLengthSecurityDescriptor
KeInitializeDpc
PsCreateSystemThread
IoInvalidateDeviceState
RtlHashUnicodeString
MmLockPagableSectionByHandle
RtlInsertUnicodePrefix
IoFreeErrorLogEntry
KeRemoveEntryDeviceQueue
IoWMIWriteEvent
IoIsOperationSynchronous
ZwQueryKey
RtlUpperString
MmSetAddressRangeModified
IoSetHardErrorOrVerifyDevice
PsGetProcessExitTime
KeBugCheck
RtlAnsiCharToUnicodeChar
IoWMIRegistrationControl
RtlAddAccessAllowedAce
IoStartNextPacket
ExReleaseFastMutexUnsafe
RtlCompareString
ExRegisterCallback
RtlExtendedIntegerMultiply
CcDeferWrite
PsReferencePrimaryToken
ExReinitializeResourceLite
IoAllocateErrorLogEntry
PsGetCurrentProcessId
PsImpersonateClient
KeDeregisterBugCheckCallback
PsGetCurrentThreadId
RtlCompareMemory
IoGetDeviceProperty
MmQuerySystemSize
RtlInitializeGenericTable
PsGetCurrentThread
KeReleaseSemaphore
RtlEqualUnicodeString
RtlMapGenericMask
IoReleaseRemoveLockAndWaitEx
ZwMapViewOfSection
RtlFindLongestRunClear
CcUnpinRepinnedBcb
MmProbeAndLockProcessPages
IoInitializeRemoveLockEx
IoWriteErrorLogEntry
KeReleaseMutex
RtlClearAllBits
MmForceSectionClosed
MmAllocatePagesForMdl
MmFlushImageSection
MmMapLockedPagesSpecifyCache
KeInitializeQueue
IoCancelIrp
ZwLoadDriver
ExIsProcessorFeaturePresent
ObMakeTemporaryObject
IofCompleteRequest
RtlWriteRegistryValue
KeWaitForMultipleObjects
SeTokenIsRestricted
IoGetStackLimits
CcRepinBcb
IoCsqRemoveIrp
IoGetLowerDeviceObject
RtlCopyString
IoCreateStreamFileObject
IoCheckEaBufferValidity
KeSetKernelStackSwapEnable
ZwOpenProcess
RtlValidSid
ZwDeleteKey
ExReleaseResourceLite
CcMdlRead
IoFreeWorkItem
CcGetFileObjectFromBcb
PoRegisterSystemState
RtlIsNameLegalDOS8Dot3
CcPurgeCacheSection
PsDereferencePrimaryToken
RtlTimeFieldsToTime
MmUnlockPages
KeRevertToUserAffinityThread
RtlSetDaclSecurityDescriptor
RtlRemoveUnicodePrefix
IofCallDriver
ZwOpenSection
KdEnableDebugger
PsRevertToSelf
PsSetLoadImageNotifyRoutine
IoInitializeTimer
MmFreeNonCachedMemory
MmFreePagesFromMdl
RtlFindSetBits
RtlDelete
RtlStringFromGUID
KeSynchronizeExecution
KeRemoveDeviceQueue
IoFreeController
KeInsertQueue
FsRtlNotifyUninitializeSync
ZwCreateFile
KeClearEvent
RtlCreateAcl
IoGetBootDiskInformation
RtlxAnsiStringToUnicodeSize
CcCopyRead
KeReadStateTimer
ZwFreeVirtualMemory
RtlxUnicodeStringToAnsiSize
KeGetCurrentThread
RtlSecondsSince1980ToTime
IoDisconnectInterrupt
KefAcquireSpinLockAtDpcLevel
KeSetTimerEx
MmIsThisAnNtAsSystem
ZwCreateSection
KeReadStateMutex
IoRegisterFileSystem
IoSetShareAccess
IoRemoveShareAccess
IoConnectInterrupt
IoDeleteSymbolicLink
ExLocalTimeToSystemTime
IoSetDeviceToVerify
FsRtlSplitLargeMcb
KeDetachProcess
IoGetCurrentProcess
IoGetRequestorProcess
ExGetPreviousMode
KeTickCount
RtlFindLastBackwardRunClear
KeUnstackDetachProcess
CcFastMdlReadWait
IoRegisterDeviceInterface
CcPreparePinWrite
IoFreeIrp
CcFlushCache
ObfReferenceObject
IoGetRelatedDeviceObject
CcZeroData
KeDelayExecutionThread
KeInitializeTimer
FsRtlGetNextFileLock
RtlAnsiStringToUnicodeString
RtlEnumerateGenericTable
ZwClose
PsGetProcessId
MmSecureVirtualMemory
MmAllocateNonCachedMemory
RtlEqualSid
RtlGetCallersAddress
DbgBreakPoint
RtlCreateUnicodeString
IoInvalidateDeviceRelations
MmUnmapReservedMapping
MmBuildMdlForNonPagedPool
RtlDowncaseUnicodeString
ObInsertObject
FsRtlCheckLockForWriteAccess
KeRemoveByKeyDeviceQueue
IoReadPartitionTableEx
FsRtlIsHpfsDbcsLegal
SeAppendPrivileges
IoGetDmaAdapter
ObReferenceObjectByPointer
ZwSetVolumeInformationFile
ZwEnumerateKey
RtlUnicodeToMultiByteN
ZwSetValueKey
RtlAreBitsSet
SeQueryAuthenticationIdToken
KeEnterCriticalRegion
MmProbeAndLockPages
RtlFindLeastSignificantBit
IoGetDeviceInterfaces
IoSetSystemPartition
KeRemoveQueue
SeReleaseSubjectContext
RtlMultiByteToUnicodeN
IoFreeMdl
KeInitializeApc
RtlCreateSecurityDescriptor
FsRtlCheckLockForReadAccess
IoAcquireVpbSpinLock
IoInitializeIrp
ExRaiseDatatypeMisalignment
RtlTimeToSecondsSince1970
IoGetDeviceAttachmentBaseRef
IoGetDriverObjectExtension
IoGetDiskDeviceObject
IoQueryFileInformation
KeInitializeSpinLock
ExRaiseAccessViolation
RtlUnicodeToOemN
RtlFindUnicodePrefix
MmMapIoSpace
Exports
Exports
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.init Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 820B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ