F:\vhDWwsSVjeFdmyxi\hXHcmciuazdnaf\hqhublaPpzmlydsjrBZCz\viaqAepQmvDnoht\ewijrOaahnEQzgmO\nRujoumdzxpqsaUcwRnpFw\dnpwokZuiDjDkgeEx.pdb
Static task
static1
Behavioral task
behavioral1
Sample
fc198469e38c6103c8991e8ee161620c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fc198469e38c6103c8991e8ee161620c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fc198469e38c6103c8991e8ee161620c_JaffaCakes118
-
Size
159KB
-
MD5
fc198469e38c6103c8991e8ee161620c
-
SHA1
ad55608f4df99c74ad5c43c2de7e2209ef70bf59
-
SHA256
d1eb36e39f67df1f6f26524c33937db573ba39d47a51f00c14d26b6484b04896
-
SHA512
a20db6db3dca995638f6207399eed98f8aa1eff83168f2c8e6e7efb4c36c4219d215ed9ec4c4d3cda80459b356d343fefca82d79d3739a39d1e9386c76f53ee6
-
SSDEEP
3072:w5alitJqcZb25uml16T5kIw5ZY0Dv0DzxOpyveIn0C2cJaJFs0r9gkJKqDm+TAnR:w5xqybbml1mkIdzwA0C2ckJ4f+iBRjv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc198469e38c6103c8991e8ee161620c_JaffaCakes118
Files
-
fc198469e38c6103c8991e8ee161620c_JaffaCakes118.dll windows:5 windows x86 arch:x86
cd3c5ae0b9117b20358227f6ae53079b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoCreateNotificationEvent
RtlSetAllBits
KeInitializeTimerEx
ZwQueryKey
IoSetShareAccess
RtlInitUnicodeString
RtlCompareString
RtlInitString
KeResetEvent
KeSetTargetProcessorDpc
RtlEqualString
KeCancelTimer
IoStartTimer
strncpy
RtlEqualUnicodeString
RtlUpperString
RtlIntegerToUnicodeString
MmMapLockedPagesSpecifyCache
RtlCharToInteger
KeInitializeSemaphore
RtlSetBits
ExReinitializeResourceLite
CcFastCopyWrite
Sections
.text Size: 24KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 804B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ