Qy001DoMainWSSK
222222222222
ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
0db1a119b9687fba046801c6caa08ed4_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0db1a119b9687fba046801c6caa08ed4_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0db1a119b9687fba046801c6caa08ed4_JaffaCakes118
Size
39KB
MD5
0db1a119b9687fba046801c6caa08ed4
SHA1
837e1437e7fb32b88423370cc2175e9bdd00e23f
SHA256
b051a201ac29381db8cf2e5839da5ea83590fe56dc53344ad49412ec9bd54d76
SHA512
59aeeb4d04b8f6d850507268b1ce706f807c96ada0971650b41289ebe4483339f46dc4fc0c97a7c885710c2b698243ada711a7639ed64ceede3ba07ad3f51bdf
SSDEEP
768:TWmM8n5kHx5PoRFVtoxonha4dJcrE78VIN7tzfQtZuY6ZefwnAYMVgAX0YgbWRZ:TPFUnPezOxeRwMN7NYtg5eWzMbZgbWRZ
Checks for missing Authenticode signature.
resource |
---|
0db1a119b9687fba046801c6caa08ed4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleHandleA
GetProcAddress
VirtualAlloc
VirtualFree
VirtualProtect
free
CreateStreamOnHGlobal
StrChrA
GetModuleFileNameExA
ImmGetContext
capCreateCaptureWindowA
BitBlt
waveInStop
listen
ShellExecuteA
IsWindow
RegCloseKey
Qy001DoMainWSSK
222222222222
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE