InstallService
RundllInstall
RundllUninstall
ServiceMain
UninstallService
Static task
static1
Behavioral task
behavioral1
Sample
0cf9daf0a9284dc4a27d1d5a769c6d45_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0cf9daf0a9284dc4a27d1d5a769c6d45_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0cf9daf0a9284dc4a27d1d5a769c6d45_JaffaCakes118
Size
212KB
MD5
0cf9daf0a9284dc4a27d1d5a769c6d45
SHA1
475e79a841bd8d66ded4d0ed1161b21f7d08801b
SHA256
e9604f950c1db05e7a028d9f5bb70852b7d38c882935648e749dc4d687a8a435
SHA512
68abc58783b8e249ba849f7681624b6fe5a96a180523f69db03ec419d3f20dd76fba5bda6b9b573a5365188d4e8f159934e087478587f93706b2f85bbe291811
SSDEEP
3072:0OFS+OfrCZmYhJ+4GOyzopavX2ximZex6iBTim64Ugp2dBttNLEPg4s8Pe:0XGThg4hy8a/2xisUBFVUgp2dxtEPe
Checks for missing Authenticode signature.
resource |
---|
0cf9daf0a9284dc4a27d1d5a769c6d45_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RegCreateKeyA
SetSecurityDescriptorDacl
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
QueryServiceStatus
ControlService
StartServiceA
CreateServiceA
OpenProcessToken
RegOpenKeyA
RegEnumKeyA
RegCreateKeyExA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
CharLowerBuffW
EnumProcessModules
EnumProcesses
GetModuleBaseNameW
SHGetFolderPathA
DeleteCriticalSection
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
MultiByteToWideChar
TerminateProcess
CreateThread
TerminateThread
CloseHandle
GetVersionExA
CreateProcessA
CreateToolhelp32Snapshot
Process32First
GetLastError
Process32Next
SetLastError
OpenProcess
GetModuleFileNameA
Sleep
OpenMutexA
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReadProcessMemory
GetCurrentProcess
VirtualQueryEx
WriteProcessMemory
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentThreadId
GetCurrentProcessId
GetTickCount
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
GetSystemTimeAsFileTime
GetCommandLineA
RtlUnwind
RaiseException
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
WriteFile
GetStdHandle
LoadLibraryA
HeapSize
GetFileAttributesA
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
SetFilePointer
ReadFile
FlushFileBuffers
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
CreateFileA
SetStdHandle
GetLocaleInfoW
GetExitCodeProcess
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
InstallService
RundllInstall
RundllUninstall
ServiceMain
UninstallService
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ