OnLogonEvent
PrxRunService
Static task
static1
Behavioral task
behavioral1
Sample
f1bf8ed17b9df697274a494194abdba3_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f1bf8ed17b9df697274a494194abdba3_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
f1bf8ed17b9df697274a494194abdba3_JaffaCakes118
Size
11KB
MD5
f1bf8ed17b9df697274a494194abdba3
SHA1
e232cf2c2ac79fc62799b3b0260d24863ea7ae5a
SHA256
0408deb2c335e28ddcbd42fa2c690bb0e3336e3bd6db538bd78b8ed076f27845
SHA512
4aa353c6c3479014bf0ed8b10808365093bbbf1e4941290ce0a30149df2bf558ee7544a35c467754d0abacf58f37ca08bda38dd878276894b0b75be8d6dd7bff
SSDEEP
192:+BKwH7fr+g5m0qZX1O+MZZaC06rkq+oVkmDQN2V6zp4s7rPBW3zpCdMej1kj:+UA7fr+D0oXE+MZZaR6r1VVvQzp4MbQt
Checks for missing Authenticode signature.
resource |
---|
f1bf8ed17b9df697274a494194abdba3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateWaitableTimerA
GetComputerNameA
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GetSystemTime
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
CreateToolhelp32Snapshot
HeapSize
OpenProcess
Process32First
Process32Next
RtlMoveMemory
SetWaitableTimer
Sleep
VirtualAllocEx
WaitForSingleObject
WriteProcessMemory
lstrcatA
lstrcmpiA
lstrlenA
CreateThread
CreateRemoteThread
CreateMutexA
HeapReAlloc
CloseHandle
wsprintfA
closesocket
connect
gethostbyname
gethostname
getsockname
htonl
htons
bind
recv
select
send
shutdown
socket
WSAStartup
WSACleanup
accept
listen
__WSAFDIsSet
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OnLogonEvent
PrxRunService
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ