__ZwFlushVirtualMemory@4
__ZwOpenThreadTokenEx@4
__ZwSetEvent@8
Static task
static1
Behavioral task
behavioral1
Sample
a1488915baf1527c55d53f751f641c7e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a1488915baf1527c55d53f751f641c7e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a1488915baf1527c55d53f751f641c7e_JaffaCakes118
Size
32KB
MD5
a1488915baf1527c55d53f751f641c7e
SHA1
a3c7568c151b3239b486603921232081e124da02
SHA256
b42b4693c9bf34cba265f1d8da287ec1d6216c6399d31156c65c4ca336e28bd0
SHA512
f49de26472e482dd91b3d57049cc050d86326bbef682aadd5dd82a94384eba1ce4048addf068a90c921184308cae2a13565ee9c062f1c2f773ee2f5c7713c1ad
SSDEEP
768:DqB6GEeh9OuWfKZxj43VF8Ptg8cELWjF36WQrKWIHgydDf:26GEWOb4xjmVFejZ0
Checks for missing Authenticode signature.
resource |
---|
a1488915baf1527c55d53f751f641c7e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MmUnmapLockedPages
MmProtectMdlSystemAddress
MmAllocateMappingAddress
MmProbeAndLockProcessPages
MmAdvanceMdl
RtlSubtreePredecessor
RtlRealSuccessor
RtlStringFromGUID
IoBuildDeviceIoControlRequest
ExFreePoolWithTag
ZwFsControlFile
ZwQueryFullAttributesFile
VerSetConditionMask
_wcsnicmp
ZwMapViewOfSection
RtlIntegerToUnicodeString
RtlCheckRegistryKey
RtlAppendUnicodeToString
RtlUnicodeStringToAnsiString
_strupr
wcsncat
RtlCompareString
MmAddPhysicalMemory
ZwSetEvent
RtlLengthSecurityDescriptor
RtlFreeAnsiString
strrchr
wcsspn
ZwOpenFile
RtlxUnicodeStringToAnsiSize
ZwDeleteKey
ZwLoadDriver
MmUnmapViewInSessionSpace
__ZwFlushVirtualMemory@4
__ZwOpenThreadTokenEx@4
__ZwSetEvent@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ