__ZwFlushBuffersFile@4
__ZwQueryQuotaInformationFile@4
__ZwSetQuotaInformationFile@8
Static task
static1
Behavioral task
behavioral1
Sample
a1333bd5dd015cd31b9acb6ec52f59ed_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a1333bd5dd015cd31b9acb6ec52f59ed_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a1333bd5dd015cd31b9acb6ec52f59ed_JaffaCakes118
Size
34KB
MD5
a1333bd5dd015cd31b9acb6ec52f59ed
SHA1
35174a481f0ba8a04c55cfff1199e5cc04b9fa73
SHA256
d898746e6ba7df9671b8824856388537025fc7fee7be28f5bfd2ebbfec66bfa4
SHA512
5cf9447bd1a20854fdd2a48f182f2c2cea749e180cc086c13591f5d4015fd2775a58a0cc400acbf0461771bf2ee0d638d88082e4d74023a6f8008326936da928
SSDEEP
768:kV3P6eQ7XpBdXhQGVqUoBTalimeyyzSgc/DTf:q3P6FpvXexBTavOWR3
Checks for missing Authenticode signature.
resource |
---|
a1333bd5dd015cd31b9acb6ec52f59ed_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MmUnmapLockedPages
MmFreeContiguousMemory
MmAllocatePagesForMdl
MmFreePagesFromMdl
MmAllocateContiguousMemory
RtlStringFromGUID
ZwFsControlFile
ZwQueryFullAttributesFile
VerSetConditionMask
IoBuildPartialMdl
_wcsnicmp
ZwMapViewOfSection
RtlIntegerToUnicodeString
RtlCheckRegistryKey
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
wcsncat
RtlCompareString
MmAddPhysicalMemory
ZwSetEvent
RtlLookupElementGenericTable
RtlLengthSecurityDescriptor
RtlFreeAnsiString
strrchr
_wcsupr
wcsspn
RtlxUnicodeStringToAnsiSize
ZwQueryInformationFile
ZwDeleteKey
ZwLoadDriver
RtlRealPredecessor
MmUnmapViewInSessionSpace
__ZwFlushBuffersFile@4
__ZwQueryQuotaInformationFile@4
__ZwSetQuotaInformationFile@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ