CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService
Static task
static1
Behavioral task
behavioral1
Sample
1a91440585351162a6dc8ad8bcb88300_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1a91440585351162a6dc8ad8bcb88300_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1a91440585351162a6dc8ad8bcb88300_JaffaCakes118
Size
316KB
MD5
1a91440585351162a6dc8ad8bcb88300
SHA1
aa9c85afb26ec6e0388adc24548bb8a45db20f93
SHA256
60ec5577a766fc80bd58deac42b00d214b95f70e42d3fabbb514dae15ab691d9
SHA512
5b422d99fb4fd70dc3e379e259e86ac0c2a6f75440c5f6e00d40b80a6a5c14a142163f03dcd0a80c3de567d88ea5d34478ea1468c600854546799d416fa05669
SSDEEP
6144:Y4gnpb/obaUMAqXaIrziVXagEDb2DSvt+WM3FXSh32BE5BU3G9y+0PFq/UD6B:cnNAmUAXpziVC2Ovt+WM3FXSh32BE5mc
Checks for missing Authenticode signature.
resource |
---|
1a91440585351162a6dc8ad8bcb88300_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MoveFileExA
GetTickCount
GetLocalTime
HeapFree
GetProcessHeap
HeapAlloc
FreeConsole
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
InitializeCriticalSection
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
ReleaseMutex
SetErrorMode
CreateMutexA
LocalSize
GetCurrentThreadId
VirtualQuery
GetSystemInfo
VirtualProtect
OpenProcess
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
OpenEventA
GetSystemDirectoryA
SetLastError
GetModuleHandleA
UnmapViewOfFile
CreateFileMappingA
CloseHandle
MapViewOfFile
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
TerminateThread
RemoveDirectoryA
LocalReAlloc
LocalFree
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
MultiByteToWideChar
GetProcAddress
FreeLibrary
GetPrivateProfileSectionNamesA
CancelIo
FindFirstFileA
FindNextFileA
FindClose
Sleep
InterlockedIncrement
VirtualAlloc
GetModuleFileNameA
WritePrivateProfileStringA
lstrcpyA
Process32First
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
GlobalSize
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorPos
SendMessageA
GetProcessWindowStation
ShowWindow
ExitWindowsEx
EnumWindows
CloseDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
PostMessageA
CreateWindowExA
IsWindow
DispatchMessageA
TranslateMessage
GetMessageA
BlockInput
DestroyCursor
LoadCursorA
OpenWindowStationA
SetProcessWindowStation
OpenDesktopA
SetThreadDesktop
CharNextA
SetWindowsHookExA
GetKeyNameTextA
GetActiveWindow
wsprintfA
GetWindowTextA
GetCursorInfo
DeleteDC
GetDIBits
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap
DeleteObject
BitBlt
SetSecurityDescriptorDacl
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueA
LsaFreeMemory
LsaOpenPolicy
LsaClose
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
FreeSid
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumKeyExA
RegEnumValueA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenProcessToken
SHGetFileInfoA
SHGetSpecialFolderPathA
SHDeleteKeyA
StrStrIA
_isctype
tolower
toupper
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
isspace
_strcmpi
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
__CxxFrameHandler
_strnicmp
ceil
_ftol
strstr
_purecall
atoi
strcpy
strcmp
strcat
memcmp
_CxxThrowException
strlen
strchr
malloc
free
_except_handler3
strrchr
sscanf
_strdup
_mbsnbcpy
sprintf
strtoul
_mbsrev
strncpy
strncat
setlocale
??0exception@@QAE@ABV0@@Z
realloc
wcstombs
srand
_beginthreadex
??1type_info@@UAE@XZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
calloc
memmove
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveOutOpen
waveOutGetNumDevs
waveInStop
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Xlen@std@@YAXXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??_7bad_alloc@std@@6B@
wctype
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADPAD0@Z
??0bad_alloc@std@@QAE@PBD@Z
?what@logic_error@std@@UBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??0logic_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??_7out_of_range@std@@6B@
??1out_of_range@std@@UAE@XZ
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
??_7logic_error@std@@6B@
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0bad_alloc@std@@QAE@ABV01@@Z
??1bad_alloc@std@@UAE@XZ
select
inet_addr
send
closesocket
WSAIoctl
setsockopt
getsockopt
inet_ntoa
gethostbyname
gethostname
WSAStartup
connect
htons
socket
htonl
ntohl
ioctlsocket
ImmGetCompositionStringA
ImmReleaseContext
ImmGetContext
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
capCreateCaptureWindowA
capGetDriverDescriptionA
ICSendMessage
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICSeqCompressFrameStart
ICOpen
ICSeqCompressFrame
WTSFreeMemory
WTSQuerySessionInformationA
CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ