__ZwLockFile@8
__ZwQuerySecurityObject@4
__ZwUnlockFile@4
Static task
static1
Behavioral task
behavioral1
Sample
25e538f23a2ff53de7de7c4c1e9e945d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
25e538f23a2ff53de7de7c4c1e9e945d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
25e538f23a2ff53de7de7c4c1e9e945d_JaffaCakes118
Size
30KB
MD5
25e538f23a2ff53de7de7c4c1e9e945d
SHA1
e2f9fa82688d59db72b3db6c351cae18c2d8fa17
SHA256
1ce5050d4634e658a3f19648755822fe3fc0445e82fe2f51ccf83fbf0a14b841
SHA512
513e0e496687f07a71d9e3f6a2da26d4bbf1cbead420499415f555d25ec2f405e0af1975dc2bd9717125db48a1074dde38b89e1961e0905ed3a9fdc3fd39b33e
SSDEEP
384:PhXjSte103G+LnA249QE6TuXLHHocbbjb41gt2c6ghOwwnOWdjTfNWY:dOFc3Q8XLHXbbHUfwyn5TfZ
Checks for missing Authenticode signature.
resource |
---|
25e538f23a2ff53de7de7c4c1e9e945d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RtlStringFromGUID
ZwFsControlFile
ZwQueryFullAttributesFile
_wcsnicmp
ZwMapViewOfSection
RtlIntegerToUnicodeString
RtlCheckRegistryKey
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
_strupr
wcsncat
MmAddPhysicalMemory
ZwSetEvent
RtlLengthSecurityDescriptor
RtlFreeAnsiString
strrchr
wcsspn
RtlxUnicodeStringToAnsiSize
ZwDeleteKey
ZwLoadDriver
MmUnmapViewInSessionSpace
__ZwLockFile@8
__ZwQuerySecurityObject@4
__ZwUnlockFile@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ