Hook_Start
Hook_Stop
PopShell
Static task
static1
Behavioral task
behavioral1
Sample
76101a4b1855d15c01e362e0037a55fd_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
76101a4b1855d15c01e362e0037a55fd_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
76101a4b1855d15c01e362e0037a55fd_JaffaCakes118
Size
64KB
MD5
76101a4b1855d15c01e362e0037a55fd
SHA1
7c588ccffc88779c769d759810e1d7ad5d4dda54
SHA256
93f9679f6d85c38c9051438b8535856a09df25cc1b7f7bb49857943aed3d4da6
SHA512
c62798db5a54ba27dbd004c6edc7228b5facf984da5059ab4f2a4a8d50e9cc124bb9dd8814e674167886b270b1c2a50a8f9139ac81a03b2d8f415ec59dd03346
SSDEEP
768:8ZVqNemvIEclgjSNliO4kqZTOi/bbZjCcD11CKa4JZcM58:83PPrMTOAXZ7pLa4bcS
Checks for missing Authenticode signature.
resource |
---|
76101a4b1855d15c01e362e0037a55fd_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetWindowsDirectoryA
WriteFile
GetLocalTime
GetTempPathA
GetSystemDirectoryA
CreatePipe
GetLastError
GetVersion
GetFileSize
Sleep
CreateFileA
SetFilePointer
CloseHandle
ReadFile
PeekNamedPipe
CreateProcessA
ExitThread
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
InterlockedIncrement
LCMapStringW
LCMapStringA
FlushFileBuffers
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
ResumeThread
CreateThread
TlsSetValue
SetEndOfFile
RtlUnwind
ExitProcess
IsBadCodePtr
InterlockedDecrement
HeapAlloc
GetCommandLineA
HeapFree
GetCurrentThreadId
TlsAlloc
TlsFree
SetLastError
TlsGetValue
FreeEnvironmentStringsA
FreeEnvironmentStringsW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
LoadStringA
SetWindowsHookExA
ToAscii
GetKeyboardState
GetFocus
GetWindow
GetWindowModuleFileNameA
GetWindowTextA
CallNextHookEx
UnhookWindowsHookEx
wsprintfA
GetActiveWindow
ntohl
inet_addr
connect
WSASetLastError
WSACleanup
setsockopt
listen
accept
send
ntohs
WSAStartup
socket
htons
bind
WSAIoctl
recv
closesocket
gethostname
gethostbyname
inet_ntoa
CloseServiceHandle
CreateServiceA
GetUserNameA
OpenServiceA
ControlService
StartServiceA
OpenSCManagerA
DeleteService
Hook_Start
Hook_Stop
PopShell
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ