DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
Static task
static1
Behavioral task
behavioral1
Sample
823f2add6d446c0e6bfcae35ae01b71a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
823f2add6d446c0e6bfcae35ae01b71a_JaffaCakes118.dll
Resource
win10v2004-20240730-en
Target
823f2add6d446c0e6bfcae35ae01b71a_JaffaCakes118
Size
220KB
MD5
823f2add6d446c0e6bfcae35ae01b71a
SHA1
cb65baee6422f38622a624d937ee6afc61ce1a9f
SHA256
c2fee6d74eb377bc8a6856530abae6187beabc214d0c45c103da1483adb89815
SHA512
510ae5b425b31f6d5c5ac1f9d64777b7923125cdc5be037cfd89ccaf171ed1731330e738e9bed67fc1f170ec399d05bcae61c940953be4246a293261a0016ebd
SSDEEP
3072:8EhXT4d1Wwxv+ooXtF/NAT2arOjpCAKhPdS9BW+sf1M696NGaF6:nYvXk2T3OjpCAodSXWp
Checks for missing Authenticode signature.
resource |
---|
823f2add6d446c0e6bfcae35ae01b71a_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
CreateThread
GetLastError
WaitForSingleObject
CloseHandle
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
LoadLibraryExW
HeapReAlloc
FreeEnvironmentStringsW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
HeapFree
HeapAlloc
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetSystemTimeAsFileTime
GetCommandLineA
GetCurrentThreadId
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsDebuggerPresent
GetProcessHeap
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
ntohs
socket
setsockopt
sendto
select
recvfrom
ntohl
inet_addr
htons
htonl
getsockname
connect
closesocket
bind
DeinitServerExtension
GetExtensionName
InitServerExtension
ReflectiveLoader
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ