DllRegisterServer
LsaApCallPackage
LsaApCallPackagePassthrough
LsaApCallPackageUntrusted
LsaApInitializePackage
LsaApLogonTerminated
LsaApLogonUser
LsaApLogonUserEx
SpInitialize
a
Static task
static1
Behavioral task
behavioral1
Sample
1a2b1a8817573849a151cd6435072def_JaffaCakes118.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
1a2b1a8817573849a151cd6435072def_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1a2b1a8817573849a151cd6435072def_JaffaCakes118
Size
30KB
MD5
1a2b1a8817573849a151cd6435072def
SHA1
19fb5830069ef45738a84ba7bc6b98369cb6ba86
SHA256
9ca65b883b44a39e15f52da6912f0dfbd57df2e5fd94edb8c0bf7449734797fa
SHA512
3711826400f9fa3515e21d1cd70bad8c377735c5314d705f151b5ec2da5ee23b01b6efc10df9f6799b7b978e01b426e26b1626729dd1dca3237a1bd604eb9d24
SSDEEP
384:NMIgJDQM/8uohzCPDkvfAnQhSyWH7FGLaInMYk7RH14VAcBIgf1RIuyEKDvM72:N6/T4XziH7FG/nMYU1wA6+EKDka
Checks for missing Authenticode signature.
resource |
---|
1a2b1a8817573849a151cd6435072def_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PathFileExistsW
StrStrW
StrCatW
StrStrIW
StrCmpW
StrCpyW
gethostbyname
inet_ntoa
VirtualQuery
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersionExA
RtlUnwind
GetModuleFileNameW
CreateThread
Sleep
CloseHandle
DisableThreadLibraryCalls
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
WaitForSingleObject
OpenMutexW
ReleaseMutex
CreateProcessW
FreeLibraryAndExitThread
GetCurrentProcessId
ProcessIdToSessionId
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
MoveFileExW
ExitThread
CreateFileW
GetFileSize
VirtualAlloc
ReadFile
FlushFileBuffers
WriteFile
GetTickCount
lstrlenW
GetSystemDirectoryW
GetVersionExW
GetSystemTime
MultiByteToWideChar
VirtualFree
GetTempPathW
LoadLibraryA
GetProcAddress
FreeLibrary
IsDebuggerPresent
lstrcpyW
LoadLibraryW
GetCurrentProcess
VirtualAllocEx
WriteProcessMemory
GetModuleHandleW
CreateRemoteThread
VirtualFreeEx
TerminateProcess
WideCharToMultiByte
lstrcatW
QueryPerformanceCounter
wsprintfA
CharLowerW
wsprintfW
InitializeSecurityDescriptor
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegOpenKeyExW
RegDeleteKeyW
RegCloseKey
RegFlushKey
SetSecurityDescriptorDacl
CoSetProxyBlanket
CoUninitialize
CoCreateInstance
CoInitializeSecurity
CoInitialize
SysAllocString
VariantInit
VariantClear
SysFreeString
DllRegisterServer
LsaApCallPackage
LsaApCallPackagePassthrough
LsaApCallPackageUntrusted
LsaApInitializePackage
LsaApLogonTerminated
LsaApLogonUser
LsaApLogonUserEx
SpInitialize
a
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ