DllCanUnloadNow
DllGetClassObject
s
Static task
static1
Behavioral task
behavioral1
Sample
1c8a13cf42b633642f9a69d4c75fcea5_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c8a13cf42b633642f9a69d4c75fcea5_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Target
1c8a13cf42b633642f9a69d4c75fcea5_JaffaCakes118
Size
63KB
MD5
1c8a13cf42b633642f9a69d4c75fcea5
SHA1
b2a95043ec93099c39be2a82319b303ef453c20a
SHA256
723d49fc52701fa631abec121017b545c77e5d93e984ac01ed9bd9941d6e4394
SHA512
75feff735dfa543d948d225b741621638ed295db8b943c8070421b0b1b1a2a4a10a4afd082db14829072e413917083eb1e634cd09e3cb87e7d7ee87760f37399
SSDEEP
768:E8dI69wzKlsLtBeuCyEhVbGzcDeilpaukovbtf3kWd82V6AUAjOIsxPCVmA394Am:qksL9OVzQuko5seNV6AUAjdsmt4AWvlD
Checks for missing Authenticode signature.
resource |
---|
1c8a13cf42b633642f9a69d4c75fcea5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
?terminate@@YAXXZ
_adjust_fdiv
_amsg_exit
_initterm
_XcptFilter
_onexit
__dllonexit
??1type_info@@UAE@XZ
strcpy
wcstombs
atoi
towlower
tolower
rand
srand
_itow
mbstowcs
strtok
memset
free
malloc
_itoa
strlen
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
??_U@YAPAXI@Z
memmove
memcpy
??_V@YAXPAX@Z
_except_handler3
WriteProcessMemory
FlushFileBuffers
CreateRemoteThread
VirtualFreeEx
LocalFree
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiW
Process32NextW
CreateFileW
GetCurrentProcess
GetFileSize
VirtualAlloc
ReadFile
VirtualFree
GetModuleFileNameW
CreateThread
lstrcpyW
CreateMutexW
GetLastError
WaitForSingleObject
WaitForMultipleObjects
GetExitCodeThread
lstrlenW
OpenMutexW
GetProcAddress
GetModuleHandleA
Sleep
WriteFile
SetFilePointer
SetEndOfFile
ReleaseMutex
GetModuleFileNameA
DisableThreadLibraryCalls
ExitProcess
LoadLibraryW
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
FreeLibrary
LoadLibraryA
GetLogicalDriveStringsW
GetDriveTypeW
DeleteFileW
GetTickCount
CreateDirectoryW
RaiseException
SystemTimeToFileTime
SetFileTime
Process32First
GetCurrentProcessId
Process32Next
GetWindowsDirectoryA
GetVolumeInformationA
GetCurrentThread
CreateProcessW
OpenMutexA
OpenEventA
TerminateThread
CreateEventW
TerminateProcess
SetFileAttributesW
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
InterlockedIncrement
InterlockedDecrement
GetVersion
InterlockedExchange
InterlockedCompareExchange
RtlUnwind
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAllocEx
OpenProcess
GetVersionExA
CloseHandle
lstrcatA
lstrcpyA
lstrlenA
LocalAlloc
lstrcatW
GetSystemTime
GetSystemMetrics
UnhookWindowsHookEx
PostMessageA
SetWindowsHookExA
CallNextHookEx
LookupPrivilegeValueA
AdjustTokenPrivileges
StartServiceA
QueryServiceStatusEx
QueryServiceConfigA
CloseServiceHandle
SetThreadToken
GetLengthSid
SetTokenInformation
DuplicateTokenEx
GetTokenInformation
SetEntriesInAclA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
ChangeServiceConfigA
ControlService
OpenServiceA
OpenSCManagerA
ConvertSidToStringSidW
IsValidSid
RegCreateKeyExW
RegDeleteValueW
RegFlushKey
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
SetSecurityInfo
OpenProcessToken
DllCanUnloadNow
DllGetClassObject
s
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ