LPKWORK
stopwork
work
Static task
static1
Behavioral task
behavioral1
Sample
2ba640727d5d800d1f21bc6b113ee566_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2ba640727d5d800d1f21bc6b113ee566_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
2ba640727d5d800d1f21bc6b113ee566_JaffaCakes118
Size
36KB
MD5
2ba640727d5d800d1f21bc6b113ee566
SHA1
4873ea0914e0aa2dbe07e5334609d053ef365559
SHA256
9a1fde2c0544480622741ad9243ca2143361b2171cdfd0ba128285967d8fe815
SHA512
7d6d964a92d6a2d1715b2aef7c36adb800187d5614d462098a338abbb85bfd2c13e29aa1d33f865d314f5143072cf564c5c88dbf303bf262a612ce3853aa8961
SSDEEP
768:WkbOQNAs6Vg5EaSS8DfU+B3B5zN1c88LSnt8mWsPkKMolVv8Grt:WaIVgiaSS8YuzjiSt85F8v1rt
Checks for missing Authenticode signature.
resource |
---|
2ba640727d5d800d1f21bc6b113ee566_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord3953
ord5710
ord6467
ord941
ord815
ord561
ord3738
ord4424
ord4622
ord4080
ord3079
ord3825
ord3831
ord3830
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5714
ord5289
ord5307
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord389
ord3229
ord5204
ord825
ord1075
ord6881
ord6657
ord5356
ord538
ord690
ord6877
ord6282
ord6283
ord2818
ord922
ord5572
ord926
ord924
ord4278
ord858
ord939
ord2764
ord6648
ord4129
ord2915
ord823
ord540
ord860
ord537
ord535
ord800
ord269
ord826
ord600
ord1578
ord1255
ord1253
ord1570
ord1197
ord1243
ord342
ord1182
ord1577
ord1168
ord1575
ord1176
ord1116
__dllonexit
_initterm
__CxxFrameHandler
sprintf
strstr
atoi
strncmp
malloc
_adjust_fdiv
_stricmp
?terminate@@YAXXZ
_except_handler3
_onexit
rand
_mbscmp
??1type_info@@UAE@XZ
free
DeleteFileA
LocalAlloc
LocalFree
GetCurrentProcessId
GetTickCount
LoadLibraryA
GetProcAddress
GetExitCodeProcess
TerminateProcess
GetShortPathNameA
GetModuleFileNameA
SetFileAttributesA
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetSystemDirectoryA
OpenProcess
WideCharToMultiByte
ReadProcessMemory
CreateMutexA
GetLastError
CloseHandle
OutputDebugStringA
CreateThread
Sleep
ExitThread
Thread32Next
OpenThread
SuspendThread
Thread32First
GetCurrentProcess
ResumeThread
FindWindowA
GetWindowThreadProcessId
FindWindowExA
wvsprintfA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
SHFileOperationA
ShellExecuteA
URLDownloadToFileA
EnumProcessModules
GetModuleFileNameExA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA
connect
closesocket
htons
gethostbyname
ioctlsocket
WSAStartup
select
send
WSACleanup
socket
LPKWORK
stopwork
work
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ