CodeMain
CodeService
LoaderMain
MainCode
MainService
ServiceCode
Behavioral task
behavioral1
Sample
93e1eafb5cc974227e6c99083497a5e5_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
93e1eafb5cc974227e6c99083497a5e5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
93e1eafb5cc974227e6c99083497a5e5_JaffaCakes118
Size
141KB
MD5
93e1eafb5cc974227e6c99083497a5e5
SHA1
ea0051ea9f94e9a748d58b7a5f5e76bc7bb1c743
SHA256
2088fba0ad0060a0b957ff1a620c813eda43f415b0b3c29ff0e17d46162f2761
SHA512
2b5f11bd5dbd402ebed988355db5480f352e7c718be0faed02484873d0b91c4f8bf51d7c6aa346a0141a03bcfd88370bda50a0892d2b6a053e39574970c9b08a
SSDEEP
3072:/fdtG79onTCBvqYzVKBaUi5zny7oidb2bl:ndSSkKk1xykidY
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
93e1eafb5cc974227e6c99083497a5e5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GlobalFree
GlobalLock
GlobalAlloc
GlobalUnlock
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
lstrcmpiA
GetCurrentThreadId
GetWindowsDirectoryA
GetTickCount
MoveFileExA
CreateToolhelp32Snapshot
GetLocalTime
GetSystemDirectoryA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
SetLastError
GetModuleFileNameA
SetFilePointer
Sleep
MoveFileA
WriteFile
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetDiskFreeSpaceExA
CreateProcessA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
FreeLibrary
lstrcatA
ExpandEnvironmentStringsA
OpenProcess
GetFileAttributesA
CancelIo
CreateEventA
InterlockedExchange
lstrcpyA
ResetEvent
EnterCriticalSection
VirtualFree
DeleteCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
LoadLibraryA
GetProcAddress
TerminateThread
CloseHandle
GetSystemInfo
SystemParametersInfoA
SendMessageA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
LoadCursorA
EnumWindows
OpenClipboard
BlockInput
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
SetProcessWindowStation
IsWindow
CloseWindow
CreateWindowExA
GetKeyState
GetAsyncKeyState
GetClipboardData
DestroyCursor
EmptyClipboard
DispatchMessageA
wsprintfA
CharNextA
MessageBoxA
ExitWindowsEx
GetWindowTextA
SetClipboardData
GetForegroundWindow
TranslateMessage
GetMessageA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
GetProcessWindowStation
OpenWindowStationA
DeleteObject
CreateDIBSection
BitBlt
GetDIBits
SelectObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
RegQueryValueA
GetTokenInformation
LookupAccountSidA
SetServiceStatus
RegisterServiceCtrlHandlerA
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserA
OpenProcessToken
IsValidSid
LookupAccountNameA
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegQueryValueExA
RegOpenKeyA
RegSetValueExA
RegCreateKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
SHGetSpecialFolderPathA
SHGetFileInfoA
SHDeleteKeyA
_strnicmp
_strupr
_stricmp
_strcmpi
_adjust_fdiv
_initterm
calloc
_beginthreadex
wcstombs
realloc
strncat
_snprintf
_errno
strchr
strncmp
atoi
strncpy
strrchr
malloc
free
_except_handler3
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
waveInStart
waveOutPrepareHeader
waveOutOpen
waveInGetNumDevs
waveInPrepareHeader
waveInAddBuffer
inet_ntoa
send
inet_addr
getsockname
bind
getpeername
accept
closesocket
recv
ntohs
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
listen
sendto
recvfrom
__WSAFDIsSet
gethostname
ioctlsocket
select
GetProfilesDirectoryA
GetUserProfileDirectoryA
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
capGetDriverDescriptionA
capCreateCaptureWindowA
ICSeqCompressFrame
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
WTSFreeMemory
WTSQueryUserToken
WTSQuerySessionInformationA
GetProcessMemoryInfo
GetModuleFileNameExA
EnumProcessModules
CodeMain
CodeService
LoaderMain
MainCode
MainService
ServiceCode
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ