ExSetHook
ExUnhook
Static task
static1
Behavioral task
behavioral1
Sample
1649e9eaf43246ae7b4bae831a195680_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1649e9eaf43246ae7b4bae831a195680_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
1649e9eaf43246ae7b4bae831a195680_JaffaCakes118
Size
70KB
MD5
1649e9eaf43246ae7b4bae831a195680
SHA1
8c6ab8867063b2e25ff45a9f5e9ae339805a08e7
SHA256
2ad043a084e630029c0b82d0be5606f0df4945fb4344c0cff4f571f9ff4ac893
SHA512
bf1546147516d63810b98ef903c1b2d75b5ce976bc71319075d246459a5ab7a7c4b82fdca92e548121fcababc6b58a446231866cccf6f0b694f8a48844810033
SSDEEP
1536:4wFbP2lnY0yb61/zjqV1gwiYXJirbXJKjuh6:4wFDEnY0yWlaVizr0jf
Checks for missing Authenticode signature.
resource |
---|
1649e9eaf43246ae7b4bae831a195680_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
CloseHandle
UnmapViewOfFile
GetCurrentThreadId
GetCurrentProcessId
lstrcmpiA
DisableThreadLibraryCalls
GlobalFree
GetVersion
Sleep
GlobalAlloc
ShowCursor
CallWindowProcA
SetWindowLongA
SetPropA
IsWindow
RemovePropA
GetWindowThreadProcessId
GetClassNameA
GetWindow
SetWindowPos
wsprintfA
GetPropA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowLongA
??3@YAXPAX@Z
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
??2@YAPAXI@Z
__CxxFrameHandler
strncpy
ExSetHook
ExUnhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ