DoRecord
KeyboardProc
MouseProc
Static task
static1
Behavioral task
behavioral1
Sample
33e2c66fb41cba103201a1273a5bc45b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
33e2c66fb41cba103201a1273a5bc45b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
33e2c66fb41cba103201a1273a5bc45b_JaffaCakes118
Size
48KB
MD5
33e2c66fb41cba103201a1273a5bc45b
SHA1
4bf39cc01c431d3779910beb88bc8d89526b33ec
SHA256
333c604ee17014463d5ff01c3f416f5ce3f8e37ab89eb6c2c279774be19225b9
SHA512
ed7c95933040022bf7d0656158d26a52f9b9a569f46f22819a2cb0526a757166774f69c316285c022d3d7aa02e3815743041f8f6ebb04a91438929f0f0ae4d92
SSDEEP
768:+TSQiJY5PNTCfghvUuTaowB9TR1R4mtEt+kcXAvlEk:ZC5PNTCfn9R1GmG+8lE
Checks for missing Authenticode signature.
resource |
---|
33e2c66fb41cba103201a1273a5bc45b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
lstrcpynA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetLocalTime
lstrcpyA
GetModuleFileNameA
DeleteFileA
ReadFile
GetFileSize
Sleep
MoveFileA
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
CallNextHookEx
GetActiveWindow
GetWindowThreadProcessId
GetWindowTextA
GetKeyState
PathRenameExtensionA
wvnsprintfA
DoRecord
KeyboardProc
MouseProc
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ