fx
fy
Static task
static1
Behavioral task
behavioral1
Sample
16e0c16c468f3a6931c2733d8713546f_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
16e0c16c468f3a6931c2733d8713546f_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
16e0c16c468f3a6931c2733d8713546f_JaffaCakes118
Size
13KB
MD5
16e0c16c468f3a6931c2733d8713546f
SHA1
1d82c05879fb054a37c8367f0b125241f0045e73
SHA256
9ae953a4b81d415d1dcd6bac89aafc37017976c0f21ab5e82b82e8cfa04dc668
SHA512
1b790f8a89926a4576e96bcb977076bcb1d5394297e8d758e6c28b2497dfc9c51a3c847f39e0344d1bcfea12a453415ae912bc21c237db2dcbde1644165b96b4
SSDEEP
384:deRNqqC4K3YZZqshuhYaBNTP9zcP2+pjwPo:g7rK32zs66VP9zN8jgo
Checks for missing Authenticode signature.
resource |
---|
16e0c16c468f3a6931c2733d8713546f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateMutexA
OpenMutexA
GetModuleFileNameA
GetCurrentProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetPrivateProfileStringA
GetProcAddress
SetLocalTime
Sleep
ReadProcessMemory
VirtualProtectEx
WriteProcessMemory
ExitProcess
GetComputerNameA
GetCurrentThread
CloseHandle
Process32Next
Process32First
CreateToolhelp32Snapshot
GetModuleHandleA
CreateThread
GetLocalTime
IsBadReadPtr
UnhookWindowsHookEx
FindWindowA
CallNextHookEx
SetWindowsHookExA
GetWindowTextA
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
_stricmp
malloc
_adjust_fdiv
_initterm
free
strcmp
sprintf
fclose
fopen
memcpy
strrchr
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
strncpy
strchr
strlen
strcpy
fread
fx
fy
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ