CancelDll
LoadDll
Static task
static1
Behavioral task
behavioral1
Sample
0f48ed1be4484c2825bc4e632d429acf_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0f48ed1be4484c2825bc4e632d429acf_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
0f48ed1be4484c2825bc4e632d429acf_JaffaCakes118
Size
90KB
MD5
0f48ed1be4484c2825bc4e632d429acf
SHA1
b2aea6758afe260a597c4db541e508b7e422453d
SHA256
68053d4d407bcda2e674e934e9db4cda7ee2e0d156b2fa7e9b6d6ca0f1d8eecb
SHA512
3f858e5788cbd07b520eceba31c331bd8b5c8844101cdc8f7d6cebeca1610f1d261d434aceeeaf13acdaca2a2d06d39c8b7481e49a6cdfad61181af2d33fa3ff
SSDEEP
1536:0LssI6lIZKovOOtL4QXEkY/ExVDD+R2ywfMQ+wle:pH6lIZSG4EEkYMnPw2yfQv4
Checks for missing Authenticode signature.
resource |
---|
0f48ed1be4484c2825bc4e632d429acf_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
time
srand
rand
_vsnprintf
tolower
strrchr
_except_handler3
malloc
strncpy
free
atoi
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strlen
sprintf
memset
_strcmpi
lstrlenA
MultiByteToWideChar
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
OpenThread
GetThreadContext
SetThreadContext
Thread32Next
EnterCriticalSection
LeaveCriticalSection
IsBadReadPtr
HeapAlloc
GetProcessHeap
Sleep
LoadLibraryA
GetComputerNameA
CloseHandle
GetFileSize
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleA
AddVectoredExceptionHandler
VirtualProtect
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CancelDll
LoadDll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE