StartCloaking
StopCloaking
Static task
static1
Behavioral task
behavioral1
Sample
71a0fe26be58a435d4d85e43c7d6ed9b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
71a0fe26be58a435d4d85e43c7d6ed9b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
71a0fe26be58a435d4d85e43c7d6ed9b_JaffaCakes118
Size
44KB
MD5
71a0fe26be58a435d4d85e43c7d6ed9b
SHA1
fccef73799f779d9fe368e7c023877bd89d8de46
SHA256
2a7563dcf9e2495d695001f36ad77493021bc6c301512530f4f3ce91f5ee0ce9
SHA512
04f2ce11808d5064c4f5132cafdbdb917022d92722e3249c40abc503abec323d64cae4577debad9ccfc4b734a4bb763079d22f669a4819845c9aef51853addc5
SSDEEP
768:RWPIBxsHJGTDtHcDgBVZRjHU4l8lmaODkW:qGTDtA8VZRnl8lb
Checks for missing Authenticode signature.
resource |
---|
71a0fe26be58a435d4d85e43c7d6ed9b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DisableThreadLibraryCalls
SetThreadPriority
GetCurrentThread
GetModuleHandleA
GetSystemInfo
GetProcAddress
CloseHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentProcessId
VirtualQuery
WriteProcessMemory
GetCurrentProcess
VirtualProtect
lstrcmpiA
LoadLibraryA
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetOEMCP
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
HeapReAlloc
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetStringTypeW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
ImageDirectoryEntryToData
StartCloaking
StopCloaking
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ