CancelDll
LoadDll
Static task
static1
Behavioral task
behavioral1
Sample
676a5b47bdf0660d3138e36785793872_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
676a5b47bdf0660d3138e36785793872_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
676a5b47bdf0660d3138e36785793872_JaffaCakes118
Size
96KB
MD5
676a5b47bdf0660d3138e36785793872
SHA1
7af9916785271151e77789c686d3d5bc3f1448ff
SHA256
f1938ae67bece9b85e2a3a615406af656fa93e5d9b3196e9568b882035087107
SHA512
f1e212c30fba2ea29fde92ed2e0e097d7f8bf825159a9b14c64b577ea213187c4528ad619a3dc14711c6db5aedb122dbedcc4686a95e477cc0af9b0cff213935
SSDEEP
1536:0LssI6lIZKovOOt5WiUzzYTZ3XeGL/rqO4pdxT55vQ3/+kymbDtY:pH6lIZS7VzzYXqpj4/+kym3tY
Checks for missing Authenticode signature.
resource |
---|
676a5b47bdf0660d3138e36785793872_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
time
srand
rand
_vsnprintf
tolower
strrchr
_except_handler3
malloc
strncpy
free
atoi
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strlen
sprintf
memset
_strcmpi
lstrlenA
MultiByteToWideChar
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
OpenThread
GetThreadContext
SetThreadContext
Thread32Next
EnterCriticalSection
LeaveCriticalSection
IsBadReadPtr
HeapAlloc
GetProcessHeap
Sleep
LoadLibraryA
GetComputerNameA
CloseHandle
GetFileSize
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleA
AddVectoredExceptionHandler
VirtualProtect
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CancelDll
LoadDll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE