__KeAttachProcess@4
__KeDetachProcess@0
__KeStackAttachProcess@4
Static task
static1
Behavioral task
behavioral1
Sample
a6cedc480a12e562982e0a7bcd61205b_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
a6cedc480a12e562982e0a7bcd61205b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a6cedc480a12e562982e0a7bcd61205b_JaffaCakes118
Size
33KB
MD5
a6cedc480a12e562982e0a7bcd61205b
SHA1
09c847339d8c3d6d15baf0eb5ba79629ab1e071a
SHA256
9c48aba3e47625579629ea34f1fe28893e519155e5f2934a35c214dfffa43e73
SHA512
955349320662cdd7104c494df15cc2629cf1017de68fabd6ab7f299afd7b63578ddc58bb3c153d15e7f1c940bff28c6f661fb8d28da4207926c7daecacab61b9
SSDEEP
768:J89DhmFx7/xU2XRCDtYPL58hKbuDwmN1qLm+NFyq5JLTf:J83mFxrq20Dqx6DNQLpQWd
Checks for missing Authenticode signature.
resource |
---|
a6cedc480a12e562982e0a7bcd61205b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeLockSubjectContext
SeReleaseSubjectContext
SeCaptureSubjectContext
MmIsDriverVerifying
SeUnlockSubjectContext
VerSetConditionMask
IoGetRelatedDeviceObject
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
_wcslwr
ZwOpenDirectoryObject
ZwSetEvent
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
wcsspn
DbgPrintEx
RtlInitializeGenericTable
memset
__KeAttachProcess@4
__KeDetachProcess@0
__KeStackAttachProcess@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ