W:\mmrzgwt\DyKCvcsW\OvwzzcvY\zkwCiOqTryCv.pdb
Static task
static1
Behavioral task
behavioral1
Sample
42034778c816a57828b60d297c6943da_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
42034778c816a57828b60d297c6943da_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
42034778c816a57828b60d297c6943da_JaffaCakes118
-
Size
135KB
-
MD5
42034778c816a57828b60d297c6943da
-
SHA1
c1ef2c8e6f9f37501f3c93a622a48d0293fa8ff8
-
SHA256
8986035c4b095d65401f1a87c4aeb2e6b0287623fc321a449a1631e70838d928
-
SHA512
de006ff2d8faeded7804dc0911930314903d22bcbacec84dafa200d1cdaef4db36355f17ab97d2a67c70ad24918079609efd6a656ae43f0dbed8d6262c08427b
-
SSDEEP
3072:FyVNlyt24C2G6NC2JAfVKHCvlyHvpkXGSCk+RgNJJI:FypRl2nJAfsMyHBFSb+RwJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 42034778c816a57828b60d297c6943da_JaffaCakes118
Files
-
42034778c816a57828b60d297c6943da_JaffaCakes118.dll windows:5 windows x86 arch:x86
4b29a521b0f4a300143848b0b1afc131
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
IoReportDetectedDevice
KeRemoveQueueDpc
ObfDereferenceObject
ZwLoadDriver
IoGetDeviceInterfaces
IoSetThreadHardErrorMode
IoSetDeviceToVerify
IoFreeMdl
RtlInitAnsiString
IoRaiseHardError
RtlCopyString
ExAllocatePoolWithQuota
RtlUpcaseUnicodeToOemN
RtlAppendStringToString
ExUuidCreate
RtlInt64ToUnicodeString
IoSetHardErrorOrVerifyDevice
KeSetTargetProcessorDpc
CcSetDirtyPinnedData
PoSetSystemState
RtlDelete
FsRtlMdlWriteCompleteDev
MmFreeContiguousMemory
RtlDowncaseUnicodeString
KdDisableDebugger
SeTokenIsAdmin
RtlValidSid
KeReleaseSemaphore
PsReferencePrimaryToken
ZwOpenKey
RtlLengthSecurityDescriptor
SeOpenObjectAuditAlarm
RtlCreateRegistryKey
CcGetFileObjectFromBcb
IoCsqRemoveIrp
ExRegisterCallback
RtlFindNextForwardRunClear
IoIsOperationSynchronous
MmSetAddressRangeModified
RtlEqualSid
FsRtlLookupLastLargeMcbEntry
IoGetTopLevelIrp
ZwPowerInformation
IoCreateDisk
KeSetImportanceDpc
PsGetCurrentProcess
IoAcquireRemoveLockEx
CcSetFileSizes
RtlVerifyVersionInfo
RtlTimeToSecondsSince1970
IoInitializeIrp
ExSystemTimeToLocalTime
CcCopyRead
RtlFindLastBackwardRunClear
IoVerifyPartitionTable
RtlIsNameLegalDOS8Dot3
RtlUnicodeStringToAnsiString
ZwMapViewOfSection
CcMapData
IoGetRequestorProcessId
IoBuildPartialMdl
RtlFindMostSignificantBit
RtlLengthRequiredSid
PoCallDriver
RtlMapGenericMask
IoGetAttachedDeviceReference
CcPreparePinWrite
IoStartNextPacket
RtlFreeAnsiString
MmMapUserAddressesToPage
ExAcquireFastMutexUnsafe
RtlAppendUnicodeToString
IoCreateFile
ExRaiseDatatypeMisalignment
ZwAllocateVirtualMemory
RtlUpperString
ObInsertObject
ZwWriteFile
KeInitializeApc
MmUnlockPagableImageSection
IoReleaseRemoveLockAndWaitEx
ExLocalTimeToSystemTime
ExAllocatePoolWithQuotaTag
IoGetDeviceAttachmentBaseRef
SeDeleteObjectAuditAlarm
MmFreeNonCachedMemory
CcIsThereDirtyData
IoWriteErrorLogEntry
PsLookupProcessByProcessId
ZwOpenProcess
MmAdvanceMdl
KeQueryTimeIncrement
MmMapLockedPagesSpecifyCache
IoWMIRegistrationControl
FsRtlIsHpfsDbcsLegal
RtlExtendedIntegerMultiply
RtlAnsiCharToUnicodeChar
IoUpdateShareAccess
DbgBreakPoint
PsGetVersion
KeLeaveCriticalRegion
IoRequestDeviceEject
KeSaveFloatingPointState
IoAllocateIrp
IoReadPartitionTable
KeWaitForMultipleObjects
ExFreePool
MmIsVerifierEnabled
ZwQueryValueKey
IoWMIWriteEvent
ZwEnumerateKey
IoAcquireVpbSpinLock
IoAcquireCancelSpinLock
MmUnmapReservedMapping
MmUnsecureVirtualMemory
KeQuerySystemTime
RtlSubAuthoritySid
PsGetProcessId
PsLookupThreadByThreadId
IoCreateSymbolicLink
PsReturnPoolQuota
RtlTimeFieldsToTime
SeImpersonateClientEx
RtlRemoveUnicodePrefix
CcFastCopyRead
MmUnmapLockedPages
PsTerminateSystemThread
MmForceSectionClosed
RtlAreBitsClear
ZwClose
IoAllocateMdl
KeEnterCriticalRegion
KeInitializeTimer
RtlWriteRegistryValue
MmGetSystemRoutineAddress
MmFreeMappingAddress
RtlCopyLuid
RtlSplay
RtlSecondsSince1970ToTime
PsGetCurrentThreadId
RtlUpperChar
ZwSetVolumeInformationFile
ObCreateObject
ZwDeleteValueKey
RtlNtStatusToDosError
IoDeleteController
RtlAddAccessAllowedAceEx
IoInitializeRemoveLockEx
RtlQueryRegistryValues
RtlxOemStringToUnicodeSize
MmAddVerifierThunks
ExFreePoolWithTag
IoCancelIrp
IoWritePartitionTableEx
IoAllocateWorkItem
RtlPrefixUnicodeString
KeSynchronizeExecution
RtlGUIDFromString
PsDereferencePrimaryToken
ExCreateCallback
MmBuildMdlForNonPagedPool
ObReferenceObjectByHandle
PoSetPowerState
IoIsWdmVersionAvailable
RtlEqualUnicodeString
FsRtlNotifyInitializeSync
KeInsertQueue
RtlNumberOfClearBits
RtlFindClearRuns
MmFreePagesFromMdl
ZwCreateSection
MmAllocateContiguousMemory
KePulseEvent
FsRtlIsNameInExpression
ZwSetValueKey
IoEnumerateDeviceObjectList
ZwOpenSymbolicLinkObject
ZwNotifyChangeKey
ExDeleteResourceLite
MmUnlockPages
KeReadStateEvent
WmiQueryTraceInformation
ObQueryNameString
CcSetBcbOwnerPointer
SeDeassignSecurity
ProbeForWrite
IoDisconnectInterrupt
RtlVolumeDeviceToDosName
PsGetThreadProcessId
FsRtlFastCheckLockForRead
PoStartNextPowerIrp
PoRequestPowerIrp
IoDetachDevice
ExDeleteNPagedLookasideList
IoReadDiskSignature
PsImpersonateClient
IoReleaseCancelSpinLock
CcFastCopyWrite
FsRtlIsTotalDeviceFailure
IoCreateDevice
RtlFindLongestRunClear
ExAllocatePoolWithTag
ZwCreateEvent
ZwQueryInformationFile
SeAccessCheck
RtlSetDaclSecurityDescriptor
SeCreateClientSecurity
KeSetKernelStackSwapEnable
ObReleaseObjectSecurity
FsRtlAllocateFileLock
SeAssignSecurity
ZwMakeTemporaryObject
RtlUnicodeToMultiByteN
CcFastMdlReadWait
KeAttachProcess
IoSetPartitionInformationEx
IoGetRelatedDeviceObject
ObOpenObjectByPointer
IofCallDriver
ObGetObjectSecurity
KeReadStateTimer
KeInitializeMutex
RtlCopySid
CcZeroData
KdEnableDebugger
MmAllocatePagesForMdl
KeInsertDeviceQueue
IoSetShareAccess
RtlEnumerateGenericTable
RtlTimeToSecondsSince1980
MmGetPhysicalAddress
DbgBreakPointWithStatus
KeInsertHeadQueue
RtlFindUnicodePrefix
FsRtlFreeFileLock
KeRemoveEntryDeviceQueue
SeValidSecurityDescriptor
IoRemoveShareAccess
ObMakeTemporaryObject
IoSetTopLevelIrp
RtlCheckRegistryKey
MmCanFileBeTruncated
ExNotifyCallback
ZwDeleteKey
CcPinRead
KeClearEvent
IoQueryDeviceDescription
KeCancelTimer
ExVerifySuite
RtlFindLeastSignificantBit
IoUnregisterFileSystem
RtlAreBitsSet
MmAllocateNonCachedMemory
IoCreateNotificationEvent
ZwUnloadDriver
ExSetResourceOwnerPointer
IoSetSystemPartition
Exports
Exports
?FreeProcessOld@@YGIF&U
?CrtSizeW@@YGK_N&U
?PutSizeOriginal@@YGMGNH&U
?InstallMemoryOriginal@@YGXPAHID&U
?ModifyEvent@@YGPAGI&U
?IsObjectEx@@YGGGMPAFN&U
?GenerateConfigOriginal@@YGKGPAN&U
?CopyThreadW@@YGPAXPAF_N&U
?ShowDate@@YGPADMGFPAD&U
?IsCommandLineA@@YGXIFIPAG&U
?GenerateOptionEx@@YGPAEM_NIN&U
?RtlMutantExW@@YGXKEEPAI&U
?InsertListItemOld@@YGINPAIE&U
?GetSystemA@@YGKEEFPAH&U
?IsValidPointerOld@@YGXD&U
?SetOptionOriginal@@YGPA_NPADDH&U
?FormatFunctionNew@@YGPAFPANIPA_N&U
?EnumProcessA@@YGKPAH&U
?CopyMemoryEx@@YGEJPAKPAMPAG&U
?FormatTimeExA@@YGPAEEGPAK&U
?RemoveProcessExA@@YGXHI&U
?SetListExA@@YGIKHPA_NK&U
?PutFolderExW@@YGPAGH&U
?PutProject@@YGHJ&U
?AddMutantEx@@YGMPAJ&U
?ModifyNameOriginal@@YGPAKKGIPAJ&U
?InvalidateSemaphoreExA@@YGGJPAJ&U
?ModifyFullNameA@@YGHEFPAG&U
?ModifyPointerEx@@YGGJKPAE&U
?InsertState@@YGGHG&U
?CrtDirectoryA@@YGFJEGPAK&U
?GetExpressionW@@YGKPAIEPADM&U
?GlobalEvent@@YGPAGH&U
?IsNotProjectEx@@YGHDPAM&U
?FindPointerExA@@YGPAJPAK&U
Sections
.text Size: 30KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 284B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 708B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ