bbbbbbbbbbbb
cccccccccccc
hi
zzzzzzzzzzzzz
Behavioral task
behavioral1
Sample
37916cf646f26a7ef9280d043d31072e_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
37916cf646f26a7ef9280d043d31072e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
37916cf646f26a7ef9280d043d31072e_JaffaCakes118
Size
106KB
MD5
37916cf646f26a7ef9280d043d31072e
SHA1
b4dadb113337890c74596e782fc0c2f13ad366ad
SHA256
60848719d514e0e16cf47d20c6fe53eaa8e50d6dac28dd521cc40dbcb4de3c5d
SHA512
de1798876c9800b67b86b59b357e71d713913ad6ec78d32554ceccddc95b5422f76dbb6e39bf8899b93a86933faeccf0c05fb2a06748d154029d9b39d53a4870
SSDEEP
1536:5KGFVTO6Ou/izV1jaeb7HOFUlRILcaZjfRxS/4ZP73TvhY7z9bq:0GFlOu/nOOFUlRIL5ZDRxSejvhY7Bq
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
37916cf646f26a7ef9280d043d31072e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
HeapFree
PeekNamedPipe
WaitForMultipleObjects
DeviceIoControl
GlobalMemoryStatus
GetSystemDirectoryA
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
LocalSize
lstrcmpiA
GetCurrentThreadId
GetTickCount
GetLocalTime
MoveFileExA
InterlockedExchange
GetCurrentProcess
GetWindowsDirectoryA
CreateToolhelp32Snapshot
Process32First
Process32Next
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetDiskFreeSpaceExA
CreateProcessA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
CreateEventA
ExpandEnvironmentStringsA
lstrcatA
lstrlenA
GetPrivateProfileSectionNamesA
OpenProcess
Sleep
CancelIo
lstrcpyA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
FreeLibrary
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
LoadLibraryA
RaiseException
GetProcAddress
TerminateThread
CloseHandle
TerminateProcess
BitBlt
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
GetDIBits
SelectObject
DeleteDC
DeleteObject
AdjustTokenPrivileges
IsValidSid
LookupAccountNameA
LsaOpenPolicy
GetTokenInformation
LookupAccountSidA
DuplicateTokenEx
SetTokenInformation
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
LookupPrivilegeValueA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegCreateKeyExA
CreateProcessAsUserA
OpenProcessToken
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
SHGetFileInfoA
SHGetSpecialFolderPathA
strrchr
atoi
exit
strncat
strchr
realloc
rand
srand
strtok
malloc
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
_strcmpi
_stricmp
free
_except_handler3
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
_beginthreadex
??2@YAPAXI@Z
_strnicmp
waveOutPrepareHeader
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutGetNumDevs
waveInGetNumDevs
waveInUnprepareHeader
waveOutWrite
waveOutOpen
waveInStart
WSAStartup
WSACleanup
getsockname
gethostname
recv
send
select
ntohs
WSAIoctl
socket
gethostbyname
htons
connect
setsockopt
closesocket
GetProfilesDirectoryA
GetUserProfileDirectoryA
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
ImmGetContext
ImmGetCompositionStringA
ImmReleaseContext
InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle
ICSendMessage
ICClose
ICSeqCompressFrameStart
ICSeqCompressFrameEnd
WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA
GetProcessMemoryInfo
GetModuleFileNameExA
EnumProcessModules
bbbbbbbbbbbb
cccccccccccc
hi
zzzzzzzzzzzzz
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ