GetFilterState
SetClientHwnd
SetFilter
SetFilterState
SetLoggingActi
SetTargetPid
Static task
static1
Behavioral task
behavioral1
Sample
PermEdit.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PermEdit.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
WPE by elektro255.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
WPE by elektro255.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
elektr.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
elektr.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
wpe.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
wpe.exe
Resource
win10v2004-20240508-en
Target
6900336a2651f53be4491fe7ced64ddf_JaffaCakes118
Size
347KB
MD5
6900336a2651f53be4491fe7ced64ddf
SHA1
33aec628f027c9b2dfa31c3326a4dd515a4df4c5
SHA256
ae02d2cec500812aaf0109c35f1421765ea0eebfbb8de26b9c7c2933dd97dd77
SHA512
009370b9cc283ccc61036d7aea5af8f4558d98d9298d19148ee1756eb06f1e02ec3cb15f73568fc7c9b718fcd3eca5d872d20ef3ca5b2d91036d3fe383d863e3
SSDEEP
6144:nP6L2thmaSP1zTynubVXaawkTEnOuIXUWoN6XkUyE9f+E6JTXnS778vYiBzCHCiG:nRhK1zmnubVXaa0ObXUhE9f+fJrS7wvD
Checks for missing Authenticode signature.
Processes:
resource |
---|
unpack001/PermEdit.exe |
unpack001/WPE by elektro255.exe |
unpack001/elektr.dll |
unpack001/wpe.exe |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
InterlockedIncrement
TlsSetValue
TlsAlloc
TlsFree
GetModuleHandleA
CreateThread
InitializeCriticalSection
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
InterlockedDecrement
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
VirtualProtect
FlushInstructionCache
GetCurrentProcess
FreeLibrary
GetProcAddress
LoadLibraryA
RtlUnwind
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
RegisterWindowMessageA
IsWindow
DefWindowProcA
DispatchMessageA
TranslateMessage
SendMessageA
DestroyWindow
UnregisterClassA
RegisterClassA
MessageBoxA
CreateWindowExA
GetMessageA
ntohs
inet_addr
getpeername
getsockname
send
GetFilterState
SetClientHwnd
SetFilter
SetFilterState
SetLoggingActi
SetTargetPid
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
MethCallEngine
ord626
ord595
ord598
ord526
EVENT_SINK_AddRef
ord528
ord529
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord608
ord716
ProcCallEngine
ord535
ord645
ord570
ord571
ord576
ord100
ord617
ord581
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ