SchedServiceMain
ServiceMain
SvchostEntry_W32Time
abc
explore
Static task
static1
Behavioral task
behavioral1
Sample
78ca3343416c4b40d7716726366e8ffe_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
78ca3343416c4b40d7716726366e8ffe_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
78ca3343416c4b40d7716726366e8ffe_JaffaCakes118
Size
167KB
MD5
78ca3343416c4b40d7716726366e8ffe
SHA1
d0d5d99a5f92e1ed73b19d8a2f2d70e384b4e465
SHA256
842915c1af04f1993819062d374b1fbda517d92be112af90cdf27f2417be1550
SHA512
9a7a0e173ce427c48e4fcb17de4775f9ead40e240d6d55260e720e04b1a27fc055207c6bfc3c74a8d7fdf7a3af36ae6b096e4c954deaaf2eaa2ffada2b546234
SSDEEP
3072:zT2Ib3xpnyhThdFw9D78W0UngS0rkJHI48ECqh92KaBdfLBRH2IvqKirFQuAfa+Y:zTjb3xpjD7909SqyxeZ2Iv1WFQ2+Q
Checks for missing Authenticode signature.
resource |
---|
78ca3343416c4b40d7716726366e8ffe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
MapViewOfFile
UnmapViewOfFile
GetVersionExA
CreateFileMappingA
CreateFileA
GlobalAlloc
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
GetSystemTime
lstrcatA
DeviceIoControl
lstrcatW
GetSystemDirectoryW
lstrcmpiW
GetModuleFileNameW
WriteFile
IsBadWritePtr
LockResource
SizeofResource
LoadResource
FindResourceA
lstrlenW
FreeLibrary
CreateFileW
HeapFree
lstrcpynA
HeapAlloc
GetProcessHeap
lstrcmpiA
DuplicateHandle
TerminateJobObject
AssignProcessToJobObject
CreateJobObjectA
LoadLibraryExA
lstrcpyA
Sleep
WaitForSingleObject
SetFileAttributesA
SetEndOfFile
SetFilePointer
CopyFileA
FlushFileBuffers
RemoveDirectoryA
GetDriveTypeA
GetLogicalDriveStringsA
InterlockedExchange
GetTempPathA
GetTickCount
GlobalFree
OpenProcess
GetStartupInfoA
CreateProcessA
GetCurrentProcess
GetCurrentThreadId
CreateEventA
GetLastError
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
LoadLibraryA
CreateThread
CloseHandle
LoadLibraryW
GetProcAddress
CreateToolhelp32Snapshot
Process32First
Process32Next
lstrcpyW
ExitProcess
VirtualQuery
wsprintfW
wsprintfA
GetInputState
PostThreadMessageA
PeekMessageA
CloseServiceHandle
DeleteService
OpenSCManagerA
OpenServiceA
CreateServiceA
StartServiceA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetSecurityInfo
SetEntriesInAclA
SetSecurityInfo
CreateProcessAsUserA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
LookupAccountSidA
GetTokenInformation
SetServiceStatus
RegisterServiceCtrlHandlerW
ControlService
RtlInitUnicodeString
RtlUnwind
NtQuerySystemInformation
NtQueryObject
RtlEqualUnicodeString
SchedServiceMain
ServiceMain
SvchostEntry_W32Time
abc
explore
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ