?HookProc@@YGJHIJ@Z
Hook
Static task
static1
Behavioral task
behavioral1
Sample
5b1841c9f1fbfaaf281c442be0702399_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5b1841c9f1fbfaaf281c442be0702399_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5b1841c9f1fbfaaf281c442be0702399_JaffaCakes118
Size
40KB
MD5
5b1841c9f1fbfaaf281c442be0702399
SHA1
2d9ec541e32c7f6bfc373f673923ea63e45a225c
SHA256
3eba06218f99d3ee66ebe3ae979689f0fd2280d5732ff3081dbba05b8d0279ee
SHA512
e6a7269ed0293d06ca959c4e786413fae2bb42d115d3273d63e5822a291263171c0bbadb7b751ab11c2dccbe701fb42b57e5a1940bc965fb61d2efe0f81ba8ed
SSDEEP
384:ewFLdEaYJ4ZmlA3c9TvI06PO33qyw3wjluGHpHOTo9Myj+OJKi:tNe4c9TvI06W36vwjlZHpuTo9TnJ
Checks for missing Authenticode signature.
resource |
---|
5b1841c9f1fbfaaf281c442be0702399_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
Module32First
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersionExA
Sleep
GetProfileStringA
CreateThread
GetPrivateProfileStringA
ReadProcessMemory
CloseHandle
OpenProcess
VirtualQueryEx
Module32Next
TerminateProcess
WriteProfileStringA
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
HeapReAlloc
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
wsprintfA
SendMessageA
FindWindowExA
FindWindowA
GetWindowThreadProcessId
GetWindowTextA
GetParent
GetClassNameA
WindowFromPoint
SetWindowsHookExA
CallNextHookEx
GetFileTitleA
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetOpenA
InternetConnectA
WSAStartup
?HookProc@@YGJHIJ@Z
Hook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ