InstallService
RundllInstall
RundllUninstall
ServiceMain
UninstallService
Static task
static1
Behavioral task
behavioral1
Sample
6f2c33a43a9b45c2fdc73767bf8f8cd5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6f2c33a43a9b45c2fdc73767bf8f8cd5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6f2c33a43a9b45c2fdc73767bf8f8cd5_JaffaCakes118
Size
200KB
MD5
6f2c33a43a9b45c2fdc73767bf8f8cd5
SHA1
5ebc68a32fbd1e751287842023d5a412683dda04
SHA256
cc670da34c3d59d6d63a8428bfae7ecfd353942220493be56c364b64f1d05553
SHA512
44a563caa773a3208afc21da5206d0e5dd0b16a67625c41b3dbcaa5222aa9d63ff521135ea108abe2f698270b783b47e47731c8e1fa0fca8c35a271e8a3b0a5d
SSDEEP
3072:pImrLiy4CK9o/ksFQrnTYZ1o/v5uD3gkuEOfi2uEGBHptqkEPgh6:6Cbq64rnTkEvwD3gGHGkEPh
Checks for missing Authenticode signature.
resource |
---|
6f2c33a43a9b45c2fdc73767bf8f8cd5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
StartServiceA
SetSecurityDescriptorDacl
OpenProcessToken
RegOpenKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenSCManagerA
OpenServiceA
DeleteService
CloseServiceHandle
QueryServiceStatus
ControlService
CreateServiceA
RegCreateKeyA
RegEnumKeyA
RegCreateKeyExA
RegDeleteKeyA
LookupPrivilegeValueA
AdjustTokenPrivileges
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
CharLowerBuffW
EnumProcessModules
EnumProcesses
GetModuleBaseNameW
SHGetFolderPathA
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
ReadFile
GetExitCodeProcess
CloseHandle
GetVersionExA
CreateToolhelp32Snapshot
Process32First
GetLastError
Process32Next
OpenProcess
GetModuleFileNameA
MultiByteToWideChar
Sleep
CreateThread
TerminateThread
CreateProcessA
SetLastError
TerminateProcess
OpenMutexA
CreateMutexA
WaitForSingleObject
ReleaseMutex
GetCurrentProcess
VirtualQueryEx
ReadProcessMemory
WriteProcessMemory
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
ExitProcess
GetCommandLineA
RtlUnwind
RaiseException
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetACP
GetOEMCP
WriteFile
GetStdHandle
LoadLibraryA
HeapSize
GetFileAttributesA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetHandleCount
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
CreateFileA
SetStdHandle
GetLocaleInfoW
InstallService
RundllInstall
RundllUninstall
ServiceMain
UninstallService
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ