CH
JustforFun1
JustforFun2
JustforFun3
ServiceMain
Behavioral task
behavioral1
Sample
02e76bb9f8c1b2f052fe39aa1e45f4a3_JaffaCakes118.dll
Resource
win7-20240221-en
Target
02e76bb9f8c1b2f052fe39aa1e45f4a3_JaffaCakes118
Size
57KB
MD5
02e76bb9f8c1b2f052fe39aa1e45f4a3
SHA1
30190306231686d0c207165426642fb90669b2a8
SHA256
9f9423b249fbca73b15df54df5b375cea9060be13c8bdaed27fefedf8d3b2696
SHA512
9f9a704b860214f4a599887972d32861731733823d1ffb2b4fd0abb5eba87b3d78676ea78d893730ccdf1895c44d2d52a5f2e616b151b2e487824a871c756152
SSDEEP
1536:/wYBv7KJ2Kjc5Z2WSScVwEfC6bCQIXnxuc:/wYBv7KJ2KA5ZdSSyw2C6bCQMnxuc
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
02e76bb9f8c1b2f052fe39aa1e45f4a3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetTickCount
ReleaseMutex
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
WriteFile
OpenEventA
GetLocalTime
GetWindowsDirectoryA
TerminateThread
OpenProcess
lstrcatA
VirtualAllocEx
GetCurrentProcess
SetLastError
GetLastError
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
lstrlenA
DeleteFileA
GetTempPathA
Sleep
CancelIo
FreeLibrary
InterlockedExchange
SetEvent
WaitForSingleObject
lstrcpyA
ResetEvent
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
LoadLibraryA
GetProcAddress
SetErrorMode
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
SetProcessWindowStation
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueA
RegOpenKeyA
RegCloseKey
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegCreateKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegEnumValueA
SHDeleteKeyA
free
_strnicmp
_strnset
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_strcmpi
calloc
_beginthreadex
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
_CxxThrowException
??2@YAPAXI@Z
_except_handler3
strncpy
strrchr
malloc
strtok
strncat
strchr
realloc
atoi
wcstombs
recv
send
gethostbyname
getsockname
ntohs
socket
closesocket
gethostname
htons
connect
WSAStartup
WSAIoctl
select
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
CH
JustforFun1
JustforFun2
JustforFun3
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ