ServiceMain
aaaaaa
bbbbbbbbbbb
Behavioral task
behavioral1
Sample
04515a091077ccaffda1d1c670fc9bb0_JaffaCakes118.exe
Resource
win7-20240221-en
Target
04515a091077ccaffda1d1c670fc9bb0_JaffaCakes118
Size
108KB
MD5
04515a091077ccaffda1d1c670fc9bb0
SHA1
d539ab5df758ec7d120fb0d66c63d3b657674d2e
SHA256
cee054e7a58b08fc853e7f5ba4b7946ced8a520698c8b227f1ea4e7fe2a6d3a3
SHA512
32ba0a95fed0ada11d33fe6126ab2442b4a73a192adff965db66ae73781053f13cba4ece635a74f0029e55a5db98985b4fc6e88d167c4e8ef5835af55c9f3992
SSDEEP
1536:traNrmbq44pc2bbKXcKEyfffQx1J1KWb75aGa4DfktSEx:traNrmbqkweXREEffQx191aZ47ktSEx
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
04515a091077ccaffda1d1c670fc9bb0_JaffaCakes118 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
HeapFree
HeapAlloc
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
WriteFile
LocalAlloc
PeekNamedPipe
WaitForMultipleObjects
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
FreeConsole
LocalSize
Process32Next
LocalReAlloc
ExpandEnvironmentStringsA
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
SetStdHandle
GetOEMCP
GetACP
FlushFileBuffers
LCMapStringW
LCMapStringA
GetLocalTime
MoveFileA
MoveFileExA
GetSystemDirectoryA
TerminateThread
GetTickCount
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
CreateProcessA
LocalFree
SetLastError
GetLastError
GetModuleFileNameA
CreateFileA
InitializeCriticalSection
SetFilePointer
ReadFile
lstrlenA
DeleteFileA
Sleep
CancelIo
InterlockedExchange
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
Process32First
GetCPInfo
GetStdHandle
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
IsBadCodePtr
IsBadReadPtr
UnhandledExceptionFilter
IsBadWritePtr
SetUnhandledExceptionFilter
ExitProcess
RtlUnwind
RaiseException
HeapReAlloc
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetModuleHandleA
IsWindowVisible
GetWindowTextA
EnumWindows
ExitWindowsEx
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
GetWindowThreadProcessId
wsprintfA
CloseDesktop
LookupPrivilegeValueA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
OpenProcessToken
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
SHDeleteKeyA
WSACleanup
WSAStartup
WSAIoctl
setsockopt
htons
gethostbyname
socket
ntohs
recv
closesocket
select
send
gethostname
getsockname
connect
_strrev
EnumProcessModules
GetModuleFileNameExA
ServiceMain
aaaaaa
bbbbbbbbbbb
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ