CancelDll
LoadDll
Static task
static1
Behavioral task
behavioral1
Sample
960ba16b5d5383d70a0aaabe75f3c4f8_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
960ba16b5d5383d70a0aaabe75f3c4f8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
960ba16b5d5383d70a0aaabe75f3c4f8_JaffaCakes118
Size
106KB
MD5
960ba16b5d5383d70a0aaabe75f3c4f8
SHA1
9f953bf5f68b5d933a684e441c3e8908de0d9f4c
SHA256
775fc0264b8aa73baba7f82173e16482632bb345168a25c66e7580079fc66069
SHA512
60d7996ac664f4fee2d589f33e5fb076134d71076256e0bb798269f8e367ee7e18778b490635aa483fc7a1f6b8350163d4e5683f727f9c33bb7c4df345e0bc88
SSDEEP
3072:pH6lIZSB8qTC4eFLyYyqvidZHQWOwWO1SJb:pFZpqTleFGYyqvidZwWOxO18b
Checks for missing Authenticode signature.
resource |
---|
960ba16b5d5383d70a0aaabe75f3c4f8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
time
srand
rand
_vsnprintf
tolower
strrchr
_except_handler3
malloc
strncpy
free
atoi
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strlen
sprintf
memset
_strcmpi
lstrlenA
MultiByteToWideChar
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
OpenThread
GetThreadContext
SetThreadContext
Thread32Next
EnterCriticalSection
LeaveCriticalSection
IsBadReadPtr
HeapAlloc
GetProcessHeap
Sleep
LoadLibraryA
GetComputerNameA
CloseHandle
GetFileSize
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleA
AddVectoredExceptionHandler
VirtualProtect
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CancelDll
LoadDll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE