DoMsCtfMonitor
InitAntiVirusScanEng
����
Static task
static1
Behavioral task
behavioral1
Sample
fad1497956572c4afb7fb69753e8e5d3_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fad1497956572c4afb7fb69753e8e5d3_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
fad1497956572c4afb7fb69753e8e5d3_JaffaCakes118
Size
104KB
MD5
fad1497956572c4afb7fb69753e8e5d3
SHA1
bd542e7891f99d251b3559315d26788f4235f819
SHA256
2142391aae2a9f3792d7473de8c94abe70e7e3003e5d03e6650e7679f0db1dad
SHA512
02eeb09e84ffae48ef80010e4a92df7acae944257f71f3229606b06df121d7144ba86848f60e630c4470deedd84ff2866c9f8f761d8623c9b565613586215102
SSDEEP
3072:qo/Rd8STizn61fofYRxYv0sSpMU4HxDH:qoZd8jL6CSh4H
Checks for missing Authenticode signature.
resource |
---|
fad1497956572c4afb7fb69753e8e5d3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapReAlloc
HeapFree
IsBadReadPtr
GetModuleFileNameA
CloseHandle
GetFileSize
CreateFileA
CopyFileA
GetProcessHeap
HeapAlloc
CreateProcessA
GetStartupInfoA
GetCommandLineA
FreeLibrary
GetProcAddress
LoadLibraryA
LCMapStringA
TerminateProcess
ExitProcess
ReadFile
GetModuleHandleA
WaitForSingleObject
ResumeThread
VirtualAllocEx
GetTickCount
LocalSize
PeekMessageA
wsprintfA
MessageBoxA
GetClassNameA
DispatchMessageA
GetMessageA
GetWindowTextA
GetWindowThreadProcessId
EnumWindows
GetWindowInfo
TranslateMessage
ShellExecuteEx
_strnicmp
calloc
??3@YAXPAX@Z
srand
rand
strrchr
??2@YAPAXI@Z
_ftol
atoi
strncmp
strchr
memmove
malloc
free
__CxxFrameHandler
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyA
PathFileExistsA
DoMsCtfMonitor
InitAntiVirusScanEng
����
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ