MainFunction
UnHook
installhook
Static task
static1
Behavioral task
behavioral1
Sample
61e6990e194cbce74284e9e9b10d8855_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
61e6990e194cbce74284e9e9b10d8855_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
61e6990e194cbce74284e9e9b10d8855_JaffaCakes118
Size
288KB
MD5
61e6990e194cbce74284e9e9b10d8855
SHA1
0837dcac08d961d4a74f6679fc13e6a1d718a285
SHA256
c3e2c087a1239ff4686950a0ddbe3de6ee321a92ac07a5bc6742b4b7265e910e
SHA512
81843b1826cd3e99fa950de7078cc581b6a6039b750682f119f1ff2fa6105c84fc476a9b4da4c619212fd247db2331518c3f20c646881fb863ca1c60bbca6952
SSDEEP
6144:GjhM6fXDhU2nqqOB8UpPoln1XporvgaDQG+9AoGzK9u2:GpTCkKPojZ+GQ2
Checks for missing Authenticode signature.
resource |
---|
61e6990e194cbce74284e9e9b10d8855_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadResource
LoadLibraryA
GetProcAddress
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalAlloc
GetTempFileNameA
FreeLibrary
FindResourceA
Module32First
ExitProcess
GetModuleHandleA
OutputDebugStringA
RemoveDirectoryA
GetCurrentThreadId
SetLastError
SizeofResource
LockResource
GetSystemTime
GetCurrentProcess
OpenProcess
TerminateProcess
GetModuleFileNameA
GetVolumeInformationA
DeleteFileA
GetSystemDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetLocalTime
GetEnvironmentVariableA
CopyFileA
GetFileTime
MoveFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
FindFirstFileA
FileTimeToSystemTime
FindNextFileA
Module32Next
CreateDirectoryA
GetFileInformationByHandle
GetLastError
TlsFree
GetVersion
TlsSetValue
GetCommandLineA
TlsAlloc
InterlockedDecrement
SetEnvironmentVariableA
InterlockedIncrement
RaiseException
GetFileType
GetFullPathNameA
HeapAlloc
GetTimeZoneInformation
HeapFree
TlsGetValue
RtlUnwind
HeapSize
HeapDestroy
HeapReAlloc
VirtualFree
VirtualAlloc
HeapCreate
SetStdHandle
IsBadWritePtr
SetHandleCount
GetStdHandle
SetEndOfFile
WideCharToMultiByte
Sleep
SetUnhandledExceptionFilter
CreateProcessA
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
IsBadReadPtr
IsBadCodePtr
FlushFileBuffers
CompareStringA
CompareStringW
CreateThread
InterlockedExchange
LCMapStringA
LCMapStringW
GetTempPathA
SetFilePointer
ReadFile
WriteFile
GetStartupInfoA
WinExec
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SetFileAttributesA
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
GetFileAttributesA
GetComputerNameA
GetVersionExA
GetLogicalDrives
GetDriveTypeA
GetDiskFreeSpaceExA
CreateToolhelp32Snapshot
Process32First
Process32Next
GetFileSize
CreateFileA
CreateMutexA
DeleteCriticalSection
GetWindowsDirectoryA
CloseHandle
GetTickCount
InitializeCriticalSection
GetExitCodeThread
TerminateThread
PostMessageA
GetWindowTextA
wvsprintfA
wsprintfA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetClassNameA
GetKeyboardState
GetKeyboardLayout
ExitWindowsEx
GetWindowLongA
GetParent
IsWindow
SendMessageA
PostThreadMessageA
PeekMessageA
GetMessageA
GetForegroundWindow
EnumChildWindows
SetTimer
KillTimer
ToAscii
RegisterClassExA
RemovePropA
LoadCursorA
SetPropA
CreateWindowExA
GetWindowThreadProcessId
GetDesktopWindow
DefWindowProcA
GetPropA
GetWindowRect
DestroyWindow
GetCursor
mouse_event
keybd_event
GetDC
GetCursorPos
DrawIcon
ReleaseDC
GetDIBits
DeleteObject
SelectObject
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
RealizePalette
SelectPalette
GetStockObject
GetObjectA
GetDeviceCaps
CreateDCA
RegCreateKeyA
UnlockServiceDatabase
RegSetValueExA
RegEnumValueA
ChangeServiceConfigA
CloseServiceHandle
OpenServiceA
LockServiceDatabase
OpenSCManagerA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
GetUserNameA
RegQueryInfoKeyA
RegEnumKeyExA
RegEnumKeyA
RegOpenKeyA
RegDeleteKeyA
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA
RegSetValueA
DeleteService
ControlService
RegDeleteValueA
ShellExecuteA
FDICopy
FCIAddFile
FCIDestroy
FCIFlushCabinet
FCICreate
FDIDestroy
FDIIsCabinet
FDICreate
StrTrimA
SHDeleteKeyA
recvfrom
sendto
ntohs
gethostname
WSARecv
WSASocketA
WSAIoctl
getsockname
WSAStartup
recv
select
send
inet_addr
connect
shutdown
htonl
bind
socket
gethostbyname
ntohl
inet_ntoa
WSACleanup
htons
closesocket
Netbios
ImmGetDescriptionA
ImmReleaseContext
ImmGetCompositionStringA
ImmGetContext
ICCompressorFree
ICClose
ICSendMessage
ICSeqCompressFrame
ICSeqCompressFrameEnd
ICOpen
ICSeqCompressFrameStart
capCreateCaptureWindowA
capGetDriverDescriptionA
waveInPrepareHeader
waveOutReset
waveOutClose
waveInClose
waveInOpen
waveInGetNumDevs
waveInUnprepareHeader
waveInAddBuffer
waveInReset
waveInStart
MainFunction
UnHook
installhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ