ServiceMain
ServiceMainEx
WlxEntry
Static task
static1
Behavioral task
behavioral1
Sample
3b5043285fe61161856448d56241f7c5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3b5043285fe61161856448d56241f7c5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3b5043285fe61161856448d56241f7c5_JaffaCakes118
Size
53KB
MD5
3b5043285fe61161856448d56241f7c5
SHA1
2b678fa0e5241ab260947994621501d392b24174
SHA256
9e9ba75c091a53d057065e53a8912e738146e465b8f23d85c025488643368edf
SHA512
92f2d98d24b022ea3824afb7d85b9fbea90b79b0e9021b78adb67d8b27105efe908fb850a28bb09fd1a95df95e223756eac5b8b73a74747f85cfbfa62a4bc336
SSDEEP
768:ZN5k0hb86V2KTnHO1Mr46Z/XrSj2dwJa30E0iGozg97dQffhd+OSmLBfXFws:LXp86V3nuF6RRwA5a7dQf59S6/FF
Checks for missing Authenticode signature.
resource |
---|
3b5043285fe61161856448d56241f7c5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteFileA
FindFirstFileA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
GetComputerNameA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
FindClose
GetEnvironmentVariableA
LoadLibraryA
LocalFree
LocalAlloc
GetLastError
Sleep
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileTime
ReadFile
GetFullPathNameA
WriteFile
GetTempFileNameA
GetTempPathA
GetDateFormatA
GetTimeFormatA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetSystemTime
FindNextFileA
WinExec
ReleaseSemaphore
ResumeThread
SetThreadContext
VirtualFree
GetThreadContext
VirtualAlloc
VirtualAllocEx
CreateProcessA
FreeLibrary
GetProcAddress
MoveFileExA
MoveFileA
CopyFileA
GetSystemDirectoryA
GetTickCount
GetExitCodeProcess
PeekNamedPipe
GetStartupInfoA
CreatePipe
lstrcpyA
lstrcpynA
DisableThreadLibraryCalls
CreateSemaphoreA
InterlockedDecrement
InterlockedIncrement
WaitForSingleObject
SetEvent
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
VirtualProtect
GetCurrentProcess
WriteProcessMemory
GetSystemTimeAsFileTime
VirtualQuery
OutputDebugStringA
HeapFree
GetProcessHeap
HeapAlloc
lstrlenA
CreateThread
CloseHandle
TerminateProcess
MessageBoxA
wvsprintfA
RegCreateKeyA
RegNotifyChangeKeyValue
RegEnumValueA
RegDeleteValueA
RegSetValueExA
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation
LookupAccountSidA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
CreateStreamOnHGlobal
NtFreeVirtualMemory
_strcmpi
strchr
NtQuerySystemInformation
memmove
NtOpenProcess
NtClose
_strlwr
strstr
memset
_aulldiv
memcpy
RtlUnwind
NtAllocateVirtualMemory
_allmul
htonl
gethostbyaddr
gethostname
WSAStartup
ioctlsocket
WSAGetLastError
select
shutdown
setsockopt
closesocket
socket
htons
accept
connect
bind
listen
getsockname
send
recv
inet_addr
gethostbyname
__WSAFDIsSet
DnsQuery_A
DnsRecordListFree
ord19
ord13
ord135
ord138
ord11
ord21
ord23
ord140
ord129
ord17
ord75
RasEnumConnectionsA
StrToIntA
StrChrA
StrCmpNA
StrStrA
ServiceMain
ServiceMainEx
WlxEntry
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ