EndWork
Runing
ServiceMain
Working
Behavioral task
behavioral1
Sample
07da97c2788bb3fa88539a5d4ab00a8a_JaffaCakes118.dll
Resource
win7-20240220-en
Target
07da97c2788bb3fa88539a5d4ab00a8a_JaffaCakes118
Size
67KB
MD5
07da97c2788bb3fa88539a5d4ab00a8a
SHA1
89a14dec151de683ed1ed7da4636591e04f5da9b
SHA256
1ca6048edd2206b99a4401b53bc1c734b6c4b0f4cd67fde80c94adfe080d4d3a
SHA512
bbfcff7623fedc140a76ed35bbc0cb32ddf4ee89e1d5a3318a4e7ebe163df30082fdc5a077c041af500e3f7ac59e9cc033ccf1c606d84665010c8bb2d13a6280
SSDEEP
768:ue+5tLcz6AVenNCdVKT/o+ySREAkGcMZ1h6GHHLVfMW/QP4uBLGPryIDK5xPQ:uTtLcWyeYd4//yEZc1GJf7/QP4uiry8
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
07da97c2788bb3fa88539a5d4ab00a8a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateFileA
GlobalMemoryStatus
GetSystemInfo
GetComputerNameA
GetVersionExA
OpenEventA
SetErrorMode
TerminateThread
CreateDirectoryA
GetCurrentProcess
lstrlenA
DeleteFileA
GetWindowsDirectoryA
SetFileAttributesA
lstrcmpiA
CopyFileA
ExpandEnvironmentStringsA
GetModuleFileNameA
ReadFile
CreateProcessA
lstrcpyA
WriteFile
GetSystemDirectoryA
ExitProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetProcessHeap
HeapAlloc
GetCurrentProcessId
CreateThread
GetLocalTime
GetTickCount
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetLastError
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
Sleep
lstrcatA
GetCurrentThreadId
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
LoadLibraryA
GetProcAddress
SetFilePointer
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
CreateWindowExA
LoadMenuA
RegisterClassA
LoadCursorA
LoadIconA
GetWindowTextA
MessageBoxA
GetStockObject
RegCloseKey
RegisterServiceCtrlHandlerA
SetServiceStatus
RegCreateKeyExA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
OpenSCManagerA
CloseServiceHandle
OpenServiceA
StartServiceA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegSaveKeyA
RegRestoreKeyA
RegSetValueExA
RegDeleteKeyA
DeleteService
UnlockServiceDatabase
_access
_strrev
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
free
calloc
malloc
strrchr
srand
_stricmp
wcstombs
atoi
??3@YAXPAX@Z
memmove
putchar
ceil
_ftol
puts
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
rand
sprintf
strncpy
_beginthreadex
WSAIoctl
WSACleanup
htons
gethostbyname
socket
recv
select
closesocket
send
inet_addr
connect
sendto
WSASocketA
htonl
getsockname
WSAStartup
setsockopt
EndWork
Runing
ServiceMain
Working
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ