install
work
Static task
static1
Behavioral task
behavioral1
Sample
1014374a0b4972adec93a015df6e4558_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1014374a0b4972adec93a015df6e4558_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Target
1014374a0b4972adec93a015df6e4558_JaffaCakes118
Size
40KB
MD5
1014374a0b4972adec93a015df6e4558
SHA1
5949077230f72510bc9639779705be73e55d072a
SHA256
df3554b884ebc1e8ada4329fcc9677bfb6f7db73b5f17ff279e5d0cce6005c5c
SHA512
5dca9d85b679eead64346b0de5bfcd5f41c7ad2e573b09eee983ec9e725be0f4bc0a750dfc8343912f9d5af8dac32a3aaceae8f2bb29fcef29a45a4ee14cf320
SSDEEP
384:y93Cw8zMAfBTXRtBDihtyFeRyE4rQtXKT4n7YA1Y166IX1DOx0nHLKlVDJ+k:y9FUMArIEEyE/tXKmBN6IXuWrkd
Checks for missing Authenticode signature.
resource |
---|
1014374a0b4972adec93a015df6e4558_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
LocalFileTimeToFileTime
SystemTimeToFileTime
GetFileTime
SetFileTime
SetFileAttributesA
MoveFileA
DeleteFileA
GetTempFileNameA
GetTempPathA
Sleep
GetModuleHandleA
CreateDirectoryA
RemoveDirectoryA
GetTickCount
CopyFileA
GetWindowsDirectoryA
ProcessIdToSessionId
GetCurrentProcessId
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
CopyFileW
DeleteFileW
SetFileAttributesW
Process32Next
Process32First
CreateToolhelp32Snapshot
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
WinExec
GetFileSize
ReadFile
FindFirstFileW
FindNextFileW
FindClose
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
VirtualAllocEx
Thread32First
Thread32Next
SetLastError
IsBadWritePtr
MultiByteToWideChar
UnmapViewOfFile
GetFileSizeEx
CreateFileMappingA
MapViewOfFile
GetFileAttributesA
WriteFile
CloseHandle
GetModuleFileNameA
VirtualAlloc
VirtualFree
RegOpenKeyExA
OpenProcessToken
DuplicateTokenEx
ImpersonateLoggedOnUser
CreateProcessAsUserA
RevertToSelf
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ChangeServiceConfigA
QueryServiceStatus
StartServiceA
RegSetValueExA
RegCloseKey
ord823
ord825
srand
rand
sprintf
wcscat
wcsstr
wcsncpy
strncpy
wcslen
_snprintf
_mbsrchr
_mbsnbcpy
__CxxFrameHandler
strstr
_ftol
ceil
wcsrchr
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
_stricmp
_wcsicmp
_wcslwr
_snwprintf
_strlwr
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetMalloc
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
PathFileExistsA
StrRetToBufW
PathFileExistsW
WTSQuerySessionInformationA
WTSEnumerateSessionsA
WTSFreeMemory
install
work
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ