__KeRemoveQueue@4
__KeRemoveQueueEx@0
__KeRundownQueue@4
Static task
static1
Behavioral task
behavioral1
Sample
eddfe361fe83701a517acd0903dd88e0_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
eddfe361fe83701a517acd0903dd88e0_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
eddfe361fe83701a517acd0903dd88e0_JaffaCakes118
Size
42KB
MD5
eddfe361fe83701a517acd0903dd88e0
SHA1
b084067de83754b24d17a962f0f4247be46725d5
SHA256
a6271888286c1aaf4929c20f76f137936f548369e26a5f986278014960082791
SHA512
402c86b801d9a69a7faa8adce2842af8b9a44290461c4b72c53f33c37d853c0f35f9130359b4e27ba32cf3e66318d178bd7615cb66cfef2c13e85a30151f29a3
SSDEEP
768:p+WT2OFpNdZv5alPs6yq3W+aELNv6MifDNM73Hxp4PgTkTf:p+fOFpNV0hyqWrMi2rRpR8
Checks for missing Authenticode signature.
resource |
---|
eddfe361fe83701a517acd0903dd88e0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeLockSubjectContext
SeReleaseSubjectContext
SeCaptureSubjectContext
MmIsDriverVerifying
SeUnlockSubjectContext
VerSetConditionMask
IoGetRelatedDeviceObject
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
_wcslwr
ZwOpenDirectoryObject
ZwSetEvent
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
wcsspn
DbgPrintEx
RtlInitializeGenericTable
memset
__KeRemoveQueue@4
__KeRemoveQueueEx@0
__KeRundownQueue@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ