FUCC
FUCK
RMain
ServiceMain
Behavioral task
behavioral1
Sample
855f4ef8c25158c9a8660d46e2bc352b_JaffaCakes118.dll
Resource
win7-20240708-en
Target
855f4ef8c25158c9a8660d46e2bc352b_JaffaCakes118
Size
60KB
MD5
855f4ef8c25158c9a8660d46e2bc352b
SHA1
b1209b2c22bfb4b6bc5d2ace931ed8bde305c076
SHA256
521e2824b7925ca6d6f09b53344b6a8347bd54c227910be969801bdb6f691a8d
SHA512
69791322d65025f7b4de29f349ae6039c210f59d0a9e7f5358857b5bf7036396cab26d51c5bf09bd2e52f0e337dc46f5265a7cb700d0a8648ee19b92346a0fff
SSDEEP
768:QAygPfWrI8cvDvCYOrKgm5AAwFJXmm7thGCLWHbCS2A5koIp:zErKKrtm5zw1GCa7CS2x
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
855f4ef8c25158c9a8660d46e2bc352b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Module32First
Thread32Next
SuspendThread
ResumeThread
OpenThread
Thread32First
GetCurrentProcessId
GetCurrentThreadId
VirtualProtect
Module32Next
GetLastError
lstrcmpiA
GetFileSize
lstrlenA
OpenProcess
RemoveDirectoryA
TerminateProcess
GetCurrentProcess
IsBadReadPtr
GetProcAddress
GetProcessHeap
CancelIo
lstrcpyA
GetModuleHandleA
GetMessageA
DispatchMessageA
TranslateMessage
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
SHGetSpecialFolderPathA
CoCreateInstance
GetProcessMemoryInfo
GetModuleInformation
_adjust_fdiv
malloc
_initterm
_except_handler3
_stricmp
_access
wcstombs
strncpy
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_beginthreadex
realloc
free
WSAStartup
setsockopt
htons
gethostbyname
socket
select
recv
closesocket
send
WSACleanup
WTSQueryUserToken
CreateEnvironmentBlock
FUCC
FUCK
RMain
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ