DisableTBS
EnableTBS
UpdateTBSList
Static task
static1
Behavioral task
behavioral1
Sample
8ed3846d189c51c6a0d69bdc4e66c1a5_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8ed3846d189c51c6a0d69bdc4e66c1a5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
8ed3846d189c51c6a0d69bdc4e66c1a5_JaffaCakes118
Size
412KB
MD5
8ed3846d189c51c6a0d69bdc4e66c1a5
SHA1
a7e0118c0479298f2ba6d8bed118367368ffa1e3
SHA256
b810af74e12019121163175d1ae040da27f31c93f6acecf677627c2bd2a09226
SHA512
626cfd5a5811e0e0ee2a0468965b82045e33f5d2c8d3d7e4906555c288c4f3c20b9b97db0e6b2cde13dee1e502fdcc382c5f84bbdcf5a7c634bb8be6b64d78b8
SSDEEP
6144:85ZXTKZ4ed6Rtj8u4bi/9OmnJGJAl+0HVwmdK:8HKLdji/5MApjK
Checks for missing Authenticode signature.
resource |
---|
8ed3846d189c51c6a0d69bdc4e66c1a5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetShortPathNameW
GetCurrentThreadId
GetLastError
WideCharToMultiByte
MultiByteToWideChar
SetEnvironmentVariableW
SetLastError
InterlockedIncrement
InterlockedDecrement
Sleep
OpenEventW
GetCurrentProcessId
SetEvent
ResetEvent
CreateEventW
TerminateThread
GetExitCodeThread
SuspendThread
ResumeThread
GetVersionExA
GetCurrentProcess
GetModuleHandleW
GetProcAddress
ExitThread
ProcessIdToSessionId
CreateFileMappingW
lstrcpynA
HeapAlloc
CloseHandle
lstrcatW
GetVersion
HeapFree
GetProcessHeap
IsBadReadPtr
GetSystemDirectoryW
lstrcpynW
OpenMutexW
CreateMutexW
ReleaseMutex
GetSystemTimeAsFileTime
GetFileSize
ReadFile
FindFirstFileW
CreateFileW
FlushFileBuffers
SetFilePointer
SetEndOfFile
FindClose
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFileTime
SetFileAttributesW
GetFileTime
LocalFileTimeToFileTime
WriteFile
GetFullPathNameW
LocalFree
GetSystemTime
SystemTimeToFileTime
GetTickCount
GetFileAttributesW
TerminateProcess
GetExitCodeProcess
OpenProcess
VirtualAllocEx
GetTempPathW
GetCurrentDirectoryW
GetWindowsDirectoryW
GetModuleHandleA
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
VirtualQueryEx
VirtualFreeEx
ReadProcessMemory
UnmapViewOfFile
FreeLibrary
DuplicateHandle
lstrlenA
IsBadStringPtrA
lstrcmpiA
MapViewOfFile
WaitForMultipleObjectsEx
Thread32First
Thread32Next
CreateToolhelp32Snapshot
LocalAlloc
InterlockedExchange
LoadLibraryA
RaiseException
GetCommandLineA
HeapSize
ExitProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
RtlUnwind
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
DisableTBS
EnableTBS
UpdateTBSList
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ