CreateProcessNotify
BRRBhone
Static task
static1
Behavioral task
behavioral1
Sample
0a8c789f103eda6622789af0c220f3c1_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
0a8c789f103eda6622789af0c220f3c1_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0a8c789f103eda6622789af0c220f3c1_JaffaCakes118
Size
49KB
MD5
0a8c789f103eda6622789af0c220f3c1
SHA1
ab8cc933b7ff6fe001c29d71678746e2b4b56b17
SHA256
da5f468cd7aaba65dea3812d0f0a9c55aea6b7ad90854bb7d3b8aea6146b8f74
SHA512
17f08421d53da9fa84ae377dbcd5498bd4039190e67e0b7bb54706d0ac31565d19907839a7c5b1bb8c1a56a6cdaa0e3c7ac06b6614a922ef1a29d7ee0ca6fdd5
SSDEEP
768:fftdPZ+lcqW1dTILGjcGxMCQvI5gE2nSnbPYXMn9zGch14N:fldPZcMdUajc0z5gEzzYXU9zGGC
Checks for missing Authenticode signature.
resource |
---|
0a8c789f103eda6622789af0c220f3c1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
_toupper
ispunct
IsLFNDriveA
ILIsEqual
memcpy
DllGetVersion
wcsncmp
_ftol
CtfImmRestoreToolbarWnd
_alldiv
CtfImmIsCiceroStartedInThread
ReadCabinetState
DAD_AutoScroll
_itow
DAD_DragLeave
ImmGetCandidateWindow
CheckEscapesA
DAD_DragEnterEx
_CIcos
_aullshr
_CIlog
CreateFileA
IsProcessorFeaturePresent
ReadFile
EnterCriticalSection
GetThreadSelectorEntry
ExitProcess
VirtualQuery
GetCurrentThreadId
SetFilePointer
SleepEx
CreateFileMappingA
GetStringTypeExA
OpenThread
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
HeapFree
SetFilePointerEx
UnmapViewOfFile
CreateEventA
MapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
RegisterWaitForInputIdle
GetSystemTime
MapViewOfFileEx
HeapAlloc
CreateProcessNotify
BRRBhone
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ