DescryptoData
ServiceRouteExA
StartServiceEx
StopServiceEx
Static task
static1
Behavioral task
behavioral1
Sample
14bb76b79002cf28263a4d0d2a8a005d_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
14bb76b79002cf28263a4d0d2a8a005d_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
14bb76b79002cf28263a4d0d2a8a005d_JaffaCakes118
Size
19KB
MD5
14bb76b79002cf28263a4d0d2a8a005d
SHA1
812fca616bb0c9b2e5e8cdb14d45b4ee3a355d8e
SHA256
8947daba1dc88d2bbd9285d142f908351a9b141aba33a6de0c457276d9a97f2e
SHA512
66166f8bbb6db195f606a92226f0157175f3225c537010cb5578aa10b5f9687a60d63f33d16e2ca395cedbbca4473d3fc281b9374fba526f4c50c032e8973bf3
SSDEEP
192:AqlYQqPtrN7alaKFe1ifB07pQiu8Di+XxuBBQ6PRQkf2Do8ZDix2DMohix6b:VOQqPf7aTFLWKiJxuBBQARQkfhxXwMa
Checks for missing Authenticode signature.
resource |
---|
14bb76b79002cf28263a4d0d2a8a005d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
strlen
RtlZeroMemory
strcpy
memcmp
memcpy
VirtualAlloc
lstrlenA
lstrcpynA
lstrcpyA
lstrcmpiA
lstrcmpA
lstrcatA
WriteProcessMemory
VirtualQueryEx
CloseHandle
CreateFileA
CreateThread
GetCurrentProcess
GetCurrentProcessId
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
LoadLibraryA
ReadFile
ReadProcessMemory
Sleep
TerminateProcess
VirtualProtectEx
VirtualFree
GetWindowThreadProcessId
KillTimer
SetTimer
SetWindowLongA
SetWindowsHookExA
UnhookWindowsHookEx
GetWindowLongA
GetWindowTextA
EnumWindows
wsprintfA
CallNextHookEx
CallWindowProcA
send
gethostname
DescryptoData
ServiceRouteExA
StartServiceEx
StopServiceEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ