ResetSSDT
ServiceMain
Behavioral task
behavioral1
Sample
f9025254a088f9cf787ad185112dc455_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f9025254a088f9cf787ad185112dc455_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f9025254a088f9cf787ad185112dc455_JaffaCakes118
Size
87KB
MD5
f9025254a088f9cf787ad185112dc455
SHA1
3d82456c2ff86241c7d95af69402c977e6f1a7ba
SHA256
cc67beb8c760117c414e17cae54148a858e9d25e55175c35cbbe15c47fa7d391
SHA512
578a49f66dac2a8e7e86cf76c09102d89a2328cf8b1bf6ceb43edfa7c3769440e16b3be487d989c4e9db84cec0e4e1a45cea3dfb25c09b11c2950645df86a62c
SSDEEP
1536:efBwpV1DHfCNcOf1cNAqSfaNuw3BsfZMy0+3hS:MBqDHfCuOf1YAqkaNuGmfZMy0+xS
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
f9025254a088f9cf787ad185112dc455_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GetVersionExA
SizeofResource
MoveFileExA
FindResourceA
DeviceIoControl
LoadLibraryExA
GetModuleHandleA
SetFileAttributesA
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
Sleep
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateThread
ResumeThread
SetEvent
CreateEventA
WaitForSingleObject
TerminateThread
CloseHandle
LoadResource
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
SystemParametersInfoA
GetClipboardData
GetSystemMetrics
SetRect
keybd_event
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
SetProcessWindowStation
IsWindow
BlockInput
DispatchMessageA
DestroyCursor
LoadCursorA
wsprintfA
CharNextA
GetDC
SendMessageA
OpenClipboard
TranslateMessage
GetMessageA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetProcessWindowStation
OpenWindowStationA
DeleteDC
CreateCompatibleDC
GetDIBits
CreateDIBSection
BitBlt
DeleteObject
SelectObject
CreateCompatibleBitmap
RegOpenKeyExA
RegQueryValueA
RegCloseKey
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegCreateKeyExA
RegDeleteKeyA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
SHGetFileInfoA
SHDeleteKeyA
_strnicmp
_strcmpi
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
atoi
realloc
strchr
strncat
strncpy
strrchr
_except_handler3
malloc
free
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInUnprepareHeader
waveInOpen
waveInClose
waveOutReset
waveOutUnprepareHeader
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInPrepareHeader
waveOutClose
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
getsockname
gethostname
send
select
closesocket
recv
ntohs
socket
WSAStartup
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
capGetDriverDescriptionA
capCreateCaptureWindowA
ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ResetSSDT
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ