D:\Kill\Took\Sell\Buy.exe
Static task
static1
Behavioral task
behavioral1
Sample
3f23c852e775cf83dc4482f44c0b8c73_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3f23c852e775cf83dc4482f44c0b8c73_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
3f23c852e775cf83dc4482f44c0b8c73_JaffaCakes118
-
Size
62KB
-
MD5
3f23c852e775cf83dc4482f44c0b8c73
-
SHA1
8ff2ed3e0500e1b7d69eda0cfcdc091e31a45d4e
-
SHA256
4706c27cc926e450ecc390e7bb52ff47fa620f3a46333189a4a56c55ada75167
-
SHA512
ee20bd05f4ea4b1a7b6145bbe988f3e46b46f1da9ce972bd3b7e08c257fa63f7e1488aed60f32e1849cf7f834a1ba3d62a45bdcdec3470cf34c53541384acd71
-
SSDEEP
1536:WESqjNKOm+sRGzJ09HhpzLYVQRPshzvUgR9o:WESqjNKM5zJ09HvYVQRkE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3f23c852e775cf83dc4482f44c0b8c73_JaffaCakes118
Files
-
3f23c852e775cf83dc4482f44c0b8c73_JaffaCakes118.dll windows:5 windows x86 arch:x86
df9e3d52179a95cd091f135f9ccf18e3
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlOemToUnicodeN
IoReadPartitionTableEx
MmAllocatePagesForMdl
PsRevertToSelf
KeRestoreFloatingPointState
RtlDelete
MmResetDriverPaging
KeFlushQueuedDpcs
IoStartPacket
IoReadDiskSignature
CcFastMdlReadWait
CcCanIWrite
CcDeferWrite
FsRtlIsHpfsDbcsLegal
CcGetFileObjectFromBcb
RtlUnicodeStringToOemString
MmMapLockedPages
ExAllocatePoolWithQuotaTag
KeSetEvent
RtlUpperChar
HalExamineMBR
PoSetSystemState
SeLockSubjectContext
CcUnpinDataForThread
RtlLengthSecurityDescriptor
KeBugCheckEx
IoRaiseHardError
PoSetPowerState
ZwWriteFile
IoAllocateAdapterChannel
KeGetCurrentThread
PsCreateSystemThread
ObOpenObjectByPointer
MmForceSectionClosed
RtlGUIDFromString
ZwFsControlFile
RtlFreeOemString
IoCreateFile
ZwClose
SeQueryAuthenticationIdToken
FsRtlFastCheckLockForRead
KeSetImportanceDpc
ZwSetSecurityObject
DbgPrompt
RtlNtStatusToDosError
MmPageEntireDriver
CcUnpinData
RtlInitString
ZwOpenProcess
CcSetReadAheadGranularity
RtlVolumeDeviceToDosName
PsGetCurrentProcess
RtlSetBits
KeReadStateEvent
SePrivilegeCheck
IoQueryDeviceDescription
KeSetPriorityThread
SeDeassignSecurity
FsRtlGetNextFileLock
IoInitializeIrp
FsRtlFastUnlockSingle
IoSetDeviceToVerify
RtlSetDaclSecurityDescriptor
IoSetThreadHardErrorMode
ZwMapViewOfSection
MmIsVerifierEnabled
IoGetAttachedDevice
KeQueryTimeIncrement
CcZeroData
RtlCreateRegistryKey
IoGetStackLimits
CcPinMappedData
RtlFreeUnicodeString
PoUnregisterSystemState
RtlFindLeastSignificantBit
SeFilterToken
MmLockPagableDataSection
KeRemoveDeviceQueue
IoCreateDevice
MmHighestUserAddress
IoCsqRemoveIrp
PsLookupProcessByProcessId
KeInitializeSpinLock
RtlFindSetBits
FsRtlCheckOplock
PoRequestPowerIrp
CcSetBcbOwnerPointer
KeSetKernelStackSwapEnable
RtlClearBits
RtlCharToInteger
IoFreeIrp
RtlSplay
MmMapUserAddressesToPage
KeReadStateSemaphore
IoSetPartitionInformationEx
IoGetAttachedDeviceReference
KeRemoveByKeyDeviceQueue
PoStartNextPowerIrp
KeDetachProcess
ZwNotifyChangeKey
FsRtlIsFatDbcsLegal
PsSetLoadImageNotifyRoutine
ObReferenceObjectByHandle
RtlInitializeBitMap
MmSetAddressRangeModified
RtlCompareMemory
IoFreeController
SeCreateClientSecurity
KeSetBasePriorityThread
FsRtlNotifyUninitializeSync
IoEnumerateDeviceObjectList
KeInitializeTimerEx
ExUuidCreate
KeWaitForMultipleObjects
PsChargeProcessPoolQuota
IoSetPartitionInformation
ObfDereferenceObject
KeRemoveQueue
RtlMapGenericMask
RtlInitUnicodeString
MmGetPhysicalAddress
RtlHashUnicodeString
ObGetObjectSecurity
MmUnlockPages
RtlFindClearRuns
ZwMakeTemporaryObject
PsGetCurrentProcessId
IoBuildSynchronousFsdRequest
IoInvalidateDeviceState
RtlAddAccessAllowedAceEx
RtlEqualUnicodeString
IoRequestDeviceEject
IoReleaseRemoveLockAndWaitEx
IoRegisterFileSystem
ExIsProcessorFeaturePresent
ZwOpenFile
IoCreateStreamFileObject
ExInitializeResourceLite
IoBuildPartialMdl
RtlAppendUnicodeToString
PsGetThreadProcessId
ZwDeleteValueKey
ZwFreeVirtualMemory
SeUnlockSubjectContext
IoInvalidateDeviceRelations
IoSetDeviceInterfaceState
IoCreateSynchronizationEvent
ExReinitializeResourceLite
IoConnectInterrupt
RtlQueryRegistryValues
DbgBreakPointWithStatus
ZwPowerInformation
ExUnregisterCallback
MmQuerySystemSize
RtlExtendedIntegerMultiply
ZwCreateFile
ExRaiseDatatypeMisalignment
IoQueryFileDosDeviceName
MmAdvanceMdl
SeDeleteObjectAuditAlarm
MmIsDriverVerifying
IoRegisterDeviceInterface
IoFreeWorkItem
CcRepinBcb
IoUpdateShareAccess
IoCreateDisk
ZwFlushKey
SeCaptureSubjectContext
FsRtlDeregisterUncProvider
IoThreadToProcess
ZwAllocateVirtualMemory
IoGetDiskDeviceObject
CcCopyRead
RtlCheckRegistryKey
IoStartTimer
RtlDeleteRegistryValue
MmSecureVirtualMemory
CcRemapBcb
ZwLoadDriver
MmAllocateContiguousMemory
RtlRandom
IoIsOperationSynchronous
KeQueryInterruptTime
RtlEqualString
KeInsertQueue
KefAcquireSpinLockAtDpcLevel
KeRegisterBugCheckCallback
IoAllocateIrp
RtlCreateSecurityDescriptor
KeInitializeEvent
CcMapData
PsGetCurrentThread
FsRtlCheckLockForReadAccess
RtlFindLongestRunClear
RtlMultiByteToUnicodeN
RtlNumberOfClearBits
KeInitializeTimer
MmAllocateNonCachedMemory
ZwCreateSection
ExRaiseStatus
ZwCreateKey
KeInitializeMutex
IoCreateSymbolicLink
CcPinRead
PsLookupThreadByThreadId
PsGetVersion
ExDeletePagedLookasideList
RtlCreateAcl
RtlAddAccessAllowedAce
IoSetSystemPartition
MmUnsecureVirtualMemory
ExSetResourceOwnerPointer
IoGetDeviceObjectPointer
KeInsertDeviceQueue
IoAcquireRemoveLockEx
ExGetExclusiveWaiterCount
ExQueueWorkItem
MmIsThisAnNtAsSystem
CcFastCopyRead
KeDelayExecutionThread
ExLocalTimeToSystemTime
RtlAreBitsClear
ZwSetVolumeInformationFile
RtlUnicodeStringToInteger
RtlUnicodeToOemN
SeOpenObjectAuditAlarm
PsReferencePrimaryToken
SeImpersonateClientEx
ObInsertObject
IofCompleteRequest
IoIsSystemThread
PsIsThreadTerminating
VerSetConditionMask
RtlAreBitsSet
FsRtlSplitLargeMcb
MmIsAddressValid
KeSynchronizeExecution
ZwCreateDirectoryObject
RtlAppendStringToString
IoCreateStreamFileObjectLite
PoRegisterSystemState
KeClearEvent
CcFlushCache
SeFreePrivileges
ExAllocatePoolWithTag
IoDisconnectInterrupt
RtlIsNameLegalDOS8Dot3
KeWaitForSingleObject
ObReferenceObjectByPointer
IoWMIRegistrationControl
IoSetHardErrorOrVerifyDevice
MmProbeAndLockProcessPages
KeInitializeQueue
RtlOemStringToUnicodeString
IoCheckQuotaBufferValidity
ExGetPreviousMode
IoMakeAssociatedIrp
MmAddVerifierThunks
FsRtlIsTotalDeviceFailure
FsRtlLookupLastLargeMcbEntry
PsDereferencePrimaryToken
ZwOpenKey
ExAllocatePool
RtlUpcaseUnicodeChar
RtlCopyString
RtlDowncaseUnicodeString
IoGetDeviceAttachmentBaseRef
IoCheckEaBufferValidity
IoSetShareAccess
CcSetDirtyPinnedData
MmBuildMdlForNonPagedPool
KeInsertQueueDpc
MmMapIoSpace
ExRaiseAccessViolation
KeSetTargetProcessorDpc
IoAcquireCancelSpinLock
strlen
KeReleaseSemaphore
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
MmFlushImageSection
PsGetCurrentThreadId
IoAcquireVpbSpinLock
IoDetachDevice
FsRtlMdlWriteCompleteDev
IoWriteErrorLogEntry
MmFreePagesFromMdl
IoReadPartitionTable
RtlxAnsiStringToUnicodeSize
SeSinglePrivilegeCheck
IoDeleteSymbolicLink
FsRtlAllocateFileLock
KeRevertToUserAffinityThread
RtlAnsiCharToUnicodeChar
IoVolumeDeviceToDosName
RtlStringFromGUID
ZwOpenSection
ZwQuerySymbolicLinkObject
ZwQueryVolumeInformationFile
CcPurgeCacheSection
RtlInitializeGenericTable
SeAccessCheck
MmAllocateMappingAddress
IoAllocateController
RtlxUnicodeStringToAnsiSize
IoGetDeviceProperty
CcUninitializeCacheMap
CcUnpinRepinnedBcb
IoDeleteController
RtlRemoveUnicodePrefix
RtlClearAllBits
KeCancelTimer
ExSetTimerResolution
IoCreateNotificationEvent
ZwDeviceIoControlFile
ExReleaseResourceLite
FsRtlCheckLockForWriteAccess
RtlSetAllBits
MmLockPagableSectionByHandle
FsRtlFreeFileLock
RtlLengthRequiredSid
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.gghgfg Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gffhfd Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pack5 Size: 1024B - Virtual size: 543B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pack4 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pack3 Size: 1024B - Virtual size: 825B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pack2 Size: 1024B - Virtual size: 825B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pack1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.pack0 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 162B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 816B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ