?dnfCallBack@@YGJHIJ@Z
codeDnfExeJmpGetMoney
codeDnfExeJmpSendUserInfo
codeQQLoginGetCard
codeQQLoginGetUserInfo
codeQQLoginSafeCode
installHook
killDnf
Static task
static1
Behavioral task
behavioral1
Sample
6515593c6310aab67b45c73d09db4e57_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6515593c6310aab67b45c73d09db4e57_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6515593c6310aab67b45c73d09db4e57_JaffaCakes118
Size
9KB
MD5
6515593c6310aab67b45c73d09db4e57
SHA1
08a15b92f8b6997c258ab31dd7f53935cba4f6e6
SHA256
d5878b4e7ec83102900ea7a67285d4ec467ed26c7ed363c7561078c8a6444c85
SHA512
1e835252ce4c2ba39ff9341d871fecef40a028311347fffa935d3e29b62c6086e609601547d49e40acf78dc3b529ae6862c8399f6dbbbcf30a8a8e1a8c85bc85
SSDEEP
192:iccIxtSsp4QmUaHeZbUtfFQkgUseRRdxMvzm+5piW/xoTxmqgXw8uL:ibIT1dHaQg9AvzmiiW/xgiE
Checks for missing Authenticode signature.
resource |
---|
6515593c6310aab67b45c73d09db4e57_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateFileA
GetProcAddress
VirtualProtect
GetFileSize
Sleep
ExitProcess
GetLastError
GetModuleFileNameA
GetSystemDirectoryA
lstrlenA
GetModuleHandleA
CreateThread
CallNextHookEx
SetWindowsHookExA
fread
fclose
sprintf
strstr
strchr
malloc
remove
fwrite
fgets
strtok
__CxxFrameHandler
strncpy
rand
free
_initterm
_adjust_fdiv
sscanf
fopen
_stricmp
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
send
closesocket
connect
htons
recv
socket
WSACleanup
inet_ntoa
gethostbyname
WSAStartup
inet_addr
?dnfCallBack@@YGJHIJ@Z
codeDnfExeJmpGetMoney
codeDnfExeJmpSendUserInfo
codeQQLoginGetCard
codeQQLoginGetUserInfo
codeQQLoginSafeCode
installHook
killDnf
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ