V:\bectGanJzHpG\mNuEbycbnvxi\stgLSjTlisxqaD\FLClGdSo\tnkzwyJ.pdb
Static task
static1
Behavioral task
behavioral1
Sample
4294c0142eb1a14aa0db63fdd642ec6d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4294c0142eb1a14aa0db63fdd642ec6d_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4294c0142eb1a14aa0db63fdd642ec6d_JaffaCakes118
-
Size
135KB
-
MD5
4294c0142eb1a14aa0db63fdd642ec6d
-
SHA1
8f8b2f9752d9ede113cd83ee51519909ec1bdc7a
-
SHA256
a565d94c0db98890484234aec3faaa9a0e08c00021f2f7ae7ad348ab7d4b7239
-
SHA512
2380704ce3bf52069d9e4899ae5d48838f85d683b72e3372f2f87a5e6ad2633373b29ebb3ac4735e9c8126106096a641e6a347e71de29ada77136146eb781a3f
-
SSDEEP
3072:GjDRvtZWvoqUJ2AG6NC2JH9fcNA9J0FvlyHvpkXGSCk+RgNJJI:GRzYAnJdfUAAyHBFSb+RwJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4294c0142eb1a14aa0db63fdd642ec6d_JaffaCakes118
Files
-
4294c0142eb1a14aa0db63fdd642ec6d_JaffaCakes118.dll windows:5 windows x86 arch:x86
4306ecd731612a0aa6216cb2d3ef9b0c
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
ntoskrnl.exe
RtlTimeToSecondsSince1980
ObInsertObject
IoEnumerateDeviceObjectList
KeQueryActiveProcessors
RtlStringFromGUID
KeQuerySystemTime
ObGetObjectSecurity
MmSecureVirtualMemory
CcRepinBcb
KeSetTimerEx
ZwQueryVolumeInformationFile
KeRundownQueue
ZwFlushKey
MmAllocateNonCachedMemory
ExDeletePagedLookasideList
RtlFindMostSignificantBit
IoDetachDevice
PoUnregisterSystemState
CcDeferWrite
RtlCompareString
ZwCreateEvent
IoOpenDeviceRegistryKey
ExReleaseResourceLite
IoDeleteController
KeCancelTimer
RtlExtendedIntegerMultiply
ExSystemTimeToLocalTime
RtlUnicodeStringToAnsiString
KeReleaseSemaphore
RtlUnicodeToOemN
ZwCreateSection
MmAllocatePagesForMdl
KeResetEvent
CcMapData
SeDeassignSecurity
IoAcquireVpbSpinLock
RtlCopyUnicodeString
KeInitializeMutex
KeSetPriorityThread
CcCanIWrite
CcFastCopyWrite
RtlEqualUnicodeString
RtlUpcaseUnicodeString
CcZeroData
MmUnlockPages
ZwCreateFile
IoGetBootDiskInformation
IoFreeWorkItem
SeTokenIsAdmin
ZwQuerySymbolicLinkObject
ZwOpenFile
IoVolumeDeviceToDosName
KeLeaveCriticalRegion
ExGetExclusiveWaiterCount
ZwOpenSection
ExRaiseStatus
CcUnpinDataForThread
IoReuseIrp
IoGetCurrentProcess
MmUnsecureVirtualMemory
RtlLengthSid
ObMakeTemporaryObject
RtlAddAccessAllowedAce
SeAppendPrivileges
RtlNumberOfClearBits
FsRtlIsHpfsDbcsLegal
KeInsertByKeyDeviceQueue
SeCaptureSubjectContext
IoCreateFile
IoSetTopLevelIrp
FsRtlNotifyInitializeSync
IoReportResourceForDetection
RtlUnicodeStringToInteger
PsGetCurrentProcessId
IoWMIWriteEvent
RtlInitializeBitMap
RtlCheckRegistryKey
PsLookupProcessByProcessId
SeValidSecurityDescriptor
KeAttachProcess
MmMapLockedPages
RtlAppendUnicodeToString
CcPurgeCacheSection
IoGetDeviceInterfaces
PsReturnPoolQuota
RtlxAnsiStringToUnicodeSize
ExVerifySuite
IofCompleteRequest
CcCopyWrite
ZwAllocateVirtualMemory
ExIsProcessorFeaturePresent
ZwQueryObject
KeDelayExecutionThread
IoAllocateController
IoGetTopLevelIrp
IoQueryFileDosDeviceName
KeWaitForSingleObject
CcMdlRead
RtlUpperChar
SeAccessCheck
IoQueueWorkItem
IoGetDeviceObjectPointer
IoCreateDevice
KeSetTargetProcessorDpc
ZwOpenSymbolicLinkObject
ExRegisterCallback
ExReinitializeResourceLite
RtlFindLastBackwardRunClear
DbgBreakPointWithStatus
RtlFindLeastSignificantBit
RtlAnsiCharToUnicodeChar
IoReleaseRemoveLockAndWaitEx
PoSetSystemState
RtlDeleteRegistryValue
SeImpersonateClientEx
RtlInitializeUnicodePrefix
RtlGetCallersAddress
ExGetPreviousMode
RtlFindClearBits
PsGetCurrentProcess
IoUpdateShareAccess
KeClearEvent
MmBuildMdlForNonPagedPool
IoVerifyPartitionTable
KeRevertToUserAffinityThread
ZwFsControlFile
RtlGetVersion
ZwEnumerateValueKey
IoAllocateWorkItem
IoRemoveShareAccess
IoIsSystemThread
ObfDereferenceObject
IoGetDeviceProperty
RtlCopyLuid
RtlSetDaclSecurityDescriptor
IoGetRequestorProcess
IoGetDeviceInterfaceAlias
MmAddVerifierThunks
RtlxOemStringToUnicodeSize
ZwCreateDirectoryObject
KeGetCurrentThread
RtlIsNameLegalDOS8Dot3
SeFreePrivileges
RtlOemStringToUnicodeString
RtlOemToUnicodeN
SeFilterToken
SeCreateClientSecurity
ZwNotifyChangeKey
FsRtlGetNextFileLock
RtlAddAccessAllowedAceEx
RtlInitString
FsRtlNotifyUninitializeSync
KeReadStateSemaphore
IoCreateDisk
CcUnpinData
IoUnregisterFileSystem
KeInitializeDpc
ZwOpenKey
SeTokenIsRestricted
IoInvalidateDeviceState
ZwMapViewOfSection
MmIsVerifierEnabled
RtlTimeToTimeFields
KeBugCheckEx
ExInitializeResourceLite
ObReferenceObjectByHandle
IoSetPartitionInformation
RtlSplay
KePulseEvent
CcFlushCache
FsRtlFreeFileLock
MmUnmapIoSpace
MmSizeOfMdl
RtlFreeAnsiString
IoSetThreadHardErrorMode
IoAllocateMdl
PsLookupThreadByThreadId
ObReleaseObjectSecurity
FsRtlCheckOplock
KeInsertQueue
RtlPrefixUnicodeString
RtlUnicodeToMultiByteN
MmMapUserAddressesToPage
RtlMultiByteToUnicodeN
IoAllocateErrorLogEntry
IoCreateStreamFileObject
RtlDeleteNoSplay
IoWriteErrorLogEntry
IoFreeErrorLogEntry
IoCreateSymbolicLink
RtlVerifyVersionInfo
IoStartPacket
ZwSetSecurityObject
WmiQueryTraceInformation
VerSetConditionMask
ExLocalTimeToSystemTime
IoRegisterDeviceInterface
IoInitializeTimer
CcUnpinRepinnedBcb
ZwSetValueKey
IoBuildPartialMdl
MmSetAddressRangeModified
IoCreateNotificationEvent
ObOpenObjectByPointer
IoAcquireCancelSpinLock
PsTerminateSystemThread
ExGetSharedWaiterCount
ZwDeleteValueKey
CcSetFileSizes
KeInitializeSpinLock
IoGetDriverObjectExtension
ExAllocatePoolWithQuota
IoDeleteDevice
MmGetSystemRoutineAddress
IoCheckQuotaBufferValidity
MmUnmapLockedPages
KeRemoveDeviceQueue
IoReadDiskSignature
ExSetResourceOwnerPointer
PsSetLoadImageNotifyRoutine
KeInitializeTimerEx
KeInitializeApc
PoRequestPowerIrp
IoReleaseVpbSpinLock
RtlAreBitsSet
MmAdvanceMdl
FsRtlMdlWriteCompleteDev
RtlInitAnsiString
RtlValidSecurityDescriptor
ExFreePool
RtlRandom
MmIsDriverVerifying
RtlLengthRequiredSid
RtlCompareUnicodeString
IoWMIRegistrationControl
KdEnableDebugger
RtlUpcaseUnicodeToOemN
IoReadPartitionTable
IoInitializeIrp
KeQueryTimeIncrement
KeInitializeDeviceQueue
KeSetKernelStackSwapEnable
IoFreeIrp
KeSetImportanceDpc
IoSetPartitionInformationEx
PsGetCurrentThread
RtlLengthSecurityDescriptor
MmPageEntireDriver
RtlCharToInteger
MmFlushImageSection
RtlInitUnicodeString
IoStopTimer
KeRemoveQueueDpc
ZwCreateKey
Exports
Exports
?IncrementHeaderOriginal@@YGFKFPAGPAJ&U
?RtlNameA@@YGPAHPAFKKI&U
?IsNotDateTimeOriginal@@YGPAIFDD&U
?EnumPointerOld@@YGHMI&U
?FindSizeOld@@YGIPAEII&U
?IsValidExpressionOriginal@@YGXHKPAGD&U
?CrtFullNameExA@@YGXH&U
?DecrementMediaTypeOld@@YGPAIDPAHD&U
?AddPenNew@@YGH_N&U
?RtlArgument@@YGDIJ&U
?ShowFilePathExA@@YGNK&U
?CancelStateExW@@YG_NPAHMMH&U
?IsValidDialogEx@@YGFPAKPAG&U
?KillSemaphoreOriginal@@YGDJGF&U
?CallPointerNew@@YGPAMDEI&U
?ModifyFolderPathA@@YGPAJPAEMH&U
?CloseThreadEx@@YGIN&U
?HideScreenEx@@YGNJIPADPAI&U
?RemoveThreadNew@@YGPA_NIGPAKN&U
?RemoveDirectory@@YGPAXI&U
?FreeCharW@@YGPAFPADPAH&U
?InsertDialogA@@YGDJDD&U
?IsNotTextW@@YGXM&U
?RtlFolderPathOld@@YGPAIFKM&U
?InvalidateSystemExA@@YGXDPAI&U
?LoadMonitor@@YGPAMEKE&U
?OnFolderEx@@YGKPAGK&U
?SendFunctionOriginal@@YGPAIKE_NF&U
?CancelTimerNew@@YGPAKJJJ&U
?KillKeyNameOriginal@@YGHMJNH&U
?CopyDateExA@@YGDHKPADPA_N&U
?IncrementWidthExA@@YGJJH&U
?DeleteFolderPathOld@@YGDFPAJPAM&U
?KillValueNew@@YGGID&U
?FormatPointerOld@@YGGIHG&U
?InsertFileOriginal@@YGPAXMPAG&U
?InvalidateModuleNew@@YGPAII&U
Sections
.text Size: 26KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.i_data Size: 1024B - Virtual size: 1020B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.e_data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostc Size: 512B - Virtual size: 28B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hosta Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.hostb Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hostd Size: 512B - Virtual size: 416B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 680B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ