CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService
_king@16
king
Static task
static1
Behavioral task
behavioral1
Sample
5c84628a423dd5f03f5ce16440ba99a6_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
5c84628a423dd5f03f5ce16440ba99a6_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5c84628a423dd5f03f5ce16440ba99a6_JaffaCakes118
Size
358KB
MD5
5c84628a423dd5f03f5ce16440ba99a6
SHA1
985c8b69c755a4aaf83a96c65576febcee0d03cc
SHA256
7575a6cfd16f9d86fb69ca8f8548c5e9102bb0c7ab4a837560af85d743235537
SHA512
7c9247e09e8947bdb0040d48f5582306bf8f3f7fe52fb1a5d727ef65588add504f8f51a212fd501cea7a8a2ba023fd2ffb6f676c04b709defe3f1a750fc49942
SSDEEP
768:efH5TziDRy0wA3ad1i21UlLXYNyHh7t37dxdI07asAV1VkJ:85igLiDNYIh9hb7asAV1Vk
Checks for missing Authenticode signature.
resource |
---|
5c84628a423dd5f03f5ce16440ba99a6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadResource
SizeofResource
FindResourceA
MultiByteToWideChar
GetProcAddress
LoadLibraryA
ReleaseMutex
GetLastError
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
VirtualAllocEx
lstrcmpiA
FindClose
FindNextFileA
lstrcpyA
FindFirstFileA
CreateFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetModuleHandleA
WriteFile
DeleteFileA
MoveFileExA
CopyFileA
GetModuleFileNameA
CreateMutexA
lstrlenA
CloseHandle
lstrcatA
Sleep
wsprintfA
RegSetValueExA
RegOpenKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyExA
memcpy
free
strstr
strncat
memset
??2@YAPAXI@Z
_beginthreadex
CoGetComCatalog
GetRPCSSInfo
ServiceMain
WhichService
_king@16
king
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ