DestoryAntiVirus
GetDllModuleControlInit
StartShell
StartShell_A
StartShell_B
StartShell_C
StartShell_D
Static task
static1
Behavioral task
behavioral1
Sample
41792b430555679a53d3182ae0aeca19_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
41792b430555679a53d3182ae0aeca19_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
41792b430555679a53d3182ae0aeca19_JaffaCakes118
Size
194KB
MD5
41792b430555679a53d3182ae0aeca19
SHA1
2d8f9c173f71b33538b2bde773ac736fdbeaa44b
SHA256
664863244fbd6eeb94008c30bd827561f745bf046804c613f41bd0845e8707ac
SHA512
bbb98bce7b65ea5cf4c4b91b1c79a2fbd9b41767a8aef8ff3abd9f2233e593493cc63cdeadd395a663006363bef054a92355efc552a40e492db6fdc1a18205ad
SSDEEP
6144:ftkLORc0rXlRRQ+WQN9XXKLyMBapjq4wcY:WORc0rXlRRQ+WQN9XXKLyMBapK
Checks for missing Authenticode signature.
resource |
---|
41792b430555679a53d3182ae0aeca19_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
htonl
sendto
closesocket
select
inet_ntoa
WSAStartup
setsockopt
send
socket
inet_addr
htons
connect
WSACleanup
gethostbyname
InternetReadFile
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
VirtualProtect
HeapFree
Sleep
SetEvent
WaitForSingleObject
lstrlenW
CreateThread
CreateEventW
lstrcpyW
WideCharToMultiByte
GetTickCount
GetVersionExW
InterlockedExchange
GetACP
GetLocaleInfoA
InitializeCriticalSection
DeleteCriticalSection
lstrcatW
GetProcAddress
GetModuleHandleW
GlobalFree
GlobalAlloc
CreateFileW
GetModuleFileNameW
GetModuleFileNameA
GetSystemDirectoryW
OpenFile
CloseHandle
GetLastError
HeapAlloc
UnmapViewOfFile
MapViewOfFile
ExitProcess
CreateProcessW
OutputDebugStringW
QueryPerformanceCounter
CopyFileW
DeleteFileW
FindClose
FindNextFileW
GetFullPathNameW
FindFirstFileW
SetCurrentDirectoryW
GetPrivateProfileStringW
LoadLibraryW
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
DeviceIoControl
GetCurrentProcess
GetExitCodeThread
VirtualFree
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
TerminateProcess
GetCurrentThreadId
SetFilePointer
ReadFile
DuplicateHandle
LoadLibraryA
RtlUnwind
GetCommandLineA
GetVersionExA
GetSystemTimeAsFileTime
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
VirtualQuery
CreateFileMappingW
HeapCreate
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
WriteFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
GetOEMCP
SetStdHandle
FlushFileBuffers
GetSystemInfo
SetEndOfFile
HeapDestroy
wsprintfW
RegisterClassExW
UpdateWindow
GetMessageW
DispatchMessageW
TranslateMessage
DefWindowProcW
PostQuitMessage
SetWindowLongW
GetClientRect
GetWindowLongW
CreateWindowExW
ShowWindow
ControlService
OpenServiceW
RegCreateKeyW
ChangeServiceConfigW
RegCloseKey
RegOpenKeyExW
RegCreateKeyA
RegDeleteKeyW
RegOpenKeyW
RegEnumKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
OpenSCManagerW
CloseServiceHandle
RegDeleteValueW
CoGetClassObject
OleSetContainedObject
OleInitialize
VariantClear
SysAllocString
VariantInit
PathRemoveFileSpecW
SHDeleteKeyW
GetModuleFileNameExW
GetModuleBaseNameW
DestoryAntiVirus
GetDllModuleControlInit
StartShell
StartShell_A
StartShell_B
StartShell_C
StartShell_D
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ