ServiceRouteEx
StartServiceEx
StopServiceEx
Static task
static1
Behavioral task
behavioral1
Sample
8ea61c1829bad5716f59d429f9dbb133_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8ea61c1829bad5716f59d429f9dbb133_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
8ea61c1829bad5716f59d429f9dbb133_JaffaCakes118
Size
24KB
MD5
8ea61c1829bad5716f59d429f9dbb133
SHA1
5dcc6329b36d35e0d0d4b146ea7377f79511e5d5
SHA256
4694def1a2c442e47bc904ca39bd77b33b1d597a66d87c9e047cd16c84ee2876
SHA512
f242bef28dce64e8e3d290b7c2033da3f7b958a264f79b346365e37d52be9d3dad2a8056182ea7912314d4e409f6a6405372f4f601c6ac364560574e84a230e3
SSDEEP
192:ZIyBm9O2CdsxIjaaE0kODuBBQ6PRQkJbJBoSC2q8pYI:myU9HxIj9huBBQARQkxoSC2qYYI
Checks for missing Authenticode signature.
resource |
---|
8ea61c1829bad5716f59d429f9dbb133_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetEvent
WriteProcessMemory
WaitForSingleObject
MultiByteToWideChar
GetCurrentDirectoryA
ReadProcessMemory
GetProcAddress
LoadLibraryA
CreateEventA
lstrlenA
Sleep
WideCharToMultiByte
lstrcatA
GetPrivateProfileStringA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA
wsprintfA
SetTimer
KillTimer
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
gethostname
send
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA
strcat
strcpy
memset
strlen
memcmp
fclose
fread
fputs
fopen
strcmp
strrchr
free
_initterm
malloc
_adjust_fdiv
_strlwr
_itoa
ServiceRouteEx
StartServiceEx
StopServiceEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ