R:\vLuTtY\kqriP\yXVzaB\nsYthSfr\ltwcQ.pdb
Static task
static1
Behavioral task
behavioral1
Sample
41d519017a204a119c0c7af2118dfa6b_JaffaCakes118.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
41d519017a204a119c0c7af2118dfa6b_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
41d519017a204a119c0c7af2118dfa6b_JaffaCakes118
-
Size
38KB
-
MD5
41d519017a204a119c0c7af2118dfa6b
-
SHA1
6708d14a87300d1f85f58a47861ea9910299b859
-
SHA256
f06ef194e94a6ac001ec0c977335869055b6775c5e35d3ee9618e5b307006c04
-
SHA512
4a2ca4b3a9ccbcc4a12f601e69686bba0f121aa38c7991545ed544d4b92d4f76eb3fafd72bae776c971b0115f0dfbc855b1d7d16af212b6ea9a002a6f140ddb9
-
SSDEEP
384:+zi2i+5PjZAQuX+BmoL7fCUdGvM6jDJlPTBwrKHbJ11rIYACXYT76vydegc5mf+Y:+Ti+9ZSUL7fh6jDJoKVMYZU6vKrqSf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 41d519017a204a119c0c7af2118dfa6b_JaffaCakes118
Files
-
41d519017a204a119c0c7af2118dfa6b_JaffaCakes118.dll windows:5 windows x86 arch:x86
669d98185b953b32b86b01282f70ba3e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlInsertUnicodePrefix
RtlEqualString
KeQuerySystemTime
IoGetDriverObjectExtension
RtlLengthRequiredSid
CcCopyRead
PoCallDriver
SeQueryInformationToken
KeInitializeTimer
MmLockPagableDataSection
ExLocalTimeToSystemTime
ZwAllocateVirtualMemory
ExRegisterCallback
IoGetAttachedDevice
IoInvalidateDeviceState
RtlMultiByteToUnicodeN
IoAcquireCancelSpinLock
RtlHashUnicodeString
PsSetLoadImageNotifyRoutine
PsLookupThreadByThreadId
Exports
Exports
?jvieoUblTWlajimlHw@@YGPANPADPAD@Z
?RgqtzcDotlw@@YGK_N@Z
?qdrkjLOxMpiGxky@@YGNE@Z
?mcyiXtmqy@@YGMJ@Z
?ufdowvPlhhO@@YGJG_N@Z
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 1024B - Virtual size: 634B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.edata Size: 512B - Virtual size: 231B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbgdir Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.dbg Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
INIT Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 512B - Virtual size: 461B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ