__KeSetIdealProcessorThread@0
__KeSetKernelStackSwapEnable@4
__KeUnstackDetachProcess@4
Static task
static1
Behavioral task
behavioral1
Sample
3e057b6cc558a20f8ff1e66d418645e6_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
3e057b6cc558a20f8ff1e66d418645e6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3e057b6cc558a20f8ff1e66d418645e6_JaffaCakes118
Size
32KB
MD5
3e057b6cc558a20f8ff1e66d418645e6
SHA1
c4b803e82ed75e2fc3b841e41195056961c33a68
SHA256
450aff6079f6ed41cb484e6337e02f1f8dc8ba8c048049ec4020d14d76bbc487
SHA512
dd37494c4e601f8d6bb4aef909e369611af4a6df6a617c9b6d2396c7161197c7fdc90192ffd9541392490b2fde75062d581814abbb2a111cfd152ff8f0474404
SSDEEP
768:9bjQEEQ7u47zq+NfDnAavyECP15YNX6No3n4STni/S2:9DPu47BBDFvyECPQJrW/t
Checks for missing Authenticode signature.
resource |
---|
3e057b6cc558a20f8ff1e66d418645e6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeFreePrivileges
SeDeleteObjectAuditAlarm
SeOpenObjectAuditAlarm
SePrivilegeCheck
SeTokenType
VerSetConditionMask
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
ZwSetEvent
_vsnwprintf
RtlTimeToTimeFields
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
IoGetTopLevelIrp
wcsspn
IoInitializeIrp
RtlInitializeGenericTable
ZwAllocateVirtualMemory
memset
__KeSetIdealProcessorThread@0
__KeSetKernelStackSwapEnable@4
__KeUnstackDetachProcess@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ