__KeAttachProcess@4
__KeDetachProcess@0
__KeStackAttachProcess@4
Static task
static1
Behavioral task
behavioral1
Sample
f70cb165e066174f706ce08c11d94c6a_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f70cb165e066174f706ce08c11d94c6a_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f70cb165e066174f706ce08c11d94c6a_JaffaCakes118
Size
42KB
MD5
f70cb165e066174f706ce08c11d94c6a
SHA1
56c19c5ac8e2f393db986f6ec980e4c5f3410bcc
SHA256
ddd6bee9e74ab6fb417fb3f96d59e622d1c72dd16335c458dfe15756bb0494e0
SHA512
af1b72dea9837c55a8626908485c4a801c0ca415c1c55fdaa1feea5049659b73262e888a7bfea6f28405d04c08751894289333478dfcdd124db22dad2329281e
SSDEEP
768:489DhmFx7/LUmnJNiONyDSL2BHRPoId1KCsG7i/Sgi3JDBWIGgm1gBO:483mFxro+Jr6SLYHRPoWdscijobGgzY
Checks for missing Authenticode signature.
resource |
---|
f70cb165e066174f706ce08c11d94c6a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeLockSubjectContext
SeReleaseSubjectContext
SeCaptureSubjectContext
MmIsDriverVerifying
SeUnlockSubjectContext
VerSetConditionMask
IoGetRelatedDeviceObject
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
_wcslwr
ZwOpenDirectoryObject
ZwSetEvent
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
wcsspn
DbgPrintEx
RtlInitializeGenericTable
memset
__KeAttachProcess@4
__KeDetachProcess@0
__KeStackAttachProcess@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ