StartW
startW
Behavioral task
behavioral1
Sample
ed6e7169456ef1f41f6a45812dda7d98_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ed6e7169456ef1f41f6a45812dda7d98_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
ed6e7169456ef1f41f6a45812dda7d98_JaffaCakes118
Size
56KB
MD5
ed6e7169456ef1f41f6a45812dda7d98
SHA1
c82733e2d394b272db6cbf49aa8a1207c8d9fb87
SHA256
85b53edb2e3476bdb29f98bd19c56baa0205e6620917e654cbe81c9745d6193d
SHA512
0e7d3dbe68de4301501df68b1eeb36bf68ca3ea61091710352f68f09f8f9b8b96888ccb2419330b2fbd7b592bd98b583aaea818345c87d591b9b0a96845b8d87
SSDEEP
768:65h+QW4yKs5INTjabOSQwrPG12nFb5GnVWs6k:63XWNKQ2jnSQyNnFbgN
resource | yara_rule |
---|---|
sample | RANSOM_mountlocker |
Checks for missing Authenticode signature.
resource |
---|
ed6e7169456ef1f41f6a45812dda7d98_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord9
GetCurrentProcess
ReleaseSemaphore
WaitForSingleObject
GetTickCount64
SetEvent
CreateThread
CreateSemaphoreA
CreateEventA
DeviceIoControl
SetFileAttributesW
lstrcmpiW
TerminateThread
ResetEvent
ReadFile
GetFileSizeEx
TlsSetValue
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
TlsGetValue
GetDriveTypeW
GetCommandLineW
QueryPerformanceFrequency
SetErrorMode
lstrlenA
TlsAlloc
GetComputerNameA
TerminateProcess
OpenProcess
lstrcmpiA
GetModuleFileNameW
GetTempPathW
CreateProcessW
GetSystemInfo
GetComputerNameW
GlobalMemoryStatus
DeleteFileW
CopyFileW
GetConsoleScreenBufferInfo
EnterCriticalSection
GetStdHandle
LeaveCriticalSection
InitializeCriticalSection
WriteConsoleW
DeleteCriticalSection
SetConsoleCursorPosition
AllocConsole
QueryPerformanceCounter
GetTickCount
Sleep
WideCharToMultiByte
GetCurrentProcessId
HeapReAlloc
SetLastError
CloseHandle
CreateFileW
WriteFile
GetLastError
FindClose
FindNextFileW
HeapFree
FindFirstFileW
GetVolumeInformationW
lstrcpyW
GetProcessHeap
HeapAlloc
lstrcatW
lstrlenW
ExitProcess
LookupAccountSidW
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
EnumServicesStatusA
CreateServiceW
CloseServiceHandle
OpenSCManagerW
OpenSCManagerA
DeleteService
ControlService
StartServiceW
QueryServiceStatusEx
OpenServiceA
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptReleaseContext
GetUserNameW
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance
NetApiBufferFree
NetGetJoinInformation
NetShareEnum
NetGetDCName
StrChrW
StrCmpNIW
StrCmpIW
StrStrIW
StrStrIA
SHRegSetUSValueW
CommandLineToArgvW
ord680
memcpy
_getch
_vsnwprintf
feof
fgetws
_wfopen
fclose
memset
SysFreeString
SysAllocString
WNetEnumResourceW
WNetCancelConnection2W
WNetOpenEnumW
WNetAddConnection2W
WNetCloseEnum
wsprintfW
RtlGetNativeSystemInformation
RtlGetVersion
ZwQuerySystemInformation
StartW
startW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ