__ZwFlushVirtualMemory@4
__ZwOpenThreadTokenEx@4
__ZwSetEvent@8
Static task
static1
Behavioral task
behavioral1
Sample
1b99b19a9cab60ddb735ae81c3f055dc_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1b99b19a9cab60ddb735ae81c3f055dc_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1b99b19a9cab60ddb735ae81c3f055dc_JaffaCakes118
Size
32KB
MD5
1b99b19a9cab60ddb735ae81c3f055dc
SHA1
3413c7493e09ee86083beeec36f62722524a3405
SHA256
15bf707020aaedfe066825a1a8d55cf3899b83e1bb0ae54af64582d403b90043
SHA512
75039dde38bb6595241d07e1f43322b525e9ba147ab01900e96cb4d469a87d85bdccacbf6574b7588160143ecf5d64810926f2b1e22e151314beba92414fd600
SSDEEP
768:kUB6ne+y9Bpc4/zHY/ZfNshsFWeLaKBHbhZ/lqAQqVDf:r6eLBp7/+lGKZQqB
Checks for missing Authenticode signature.
resource |
---|
1b99b19a9cab60ddb735ae81c3f055dc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MmUnmapLockedPages
MmProtectMdlSystemAddress
MmAllocateMappingAddress
MmProbeAndLockProcessPages
MmAdvanceMdl
RtlSubtreePredecessor
RtlRealSuccessor
RtlStringFromGUID
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
ZwFsControlFile
ZwQueryFullAttributesFile
VerSetConditionMask
_wcsnicmp
ZwMapViewOfSection
RtlIntegerToUnicodeString
RtlCheckRegistryKey
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
_strupr
wcsncat
RtlCompareString
MmAddPhysicalMemory
ZwSetEvent
RtlLengthSecurityDescriptor
RtlFreeAnsiString
strrchr
wcsspn
ZwOpenFile
RtlxUnicodeStringToAnsiSize
ZwDeleteKey
ZwLoadDriver
MmUnmapViewInSessionSpace
__ZwFlushVirtualMemory@4
__ZwOpenThreadTokenEx@4
__ZwSetEvent@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ