CreateProcessNotify
ciphlpr
Static task
static1
Behavioral task
behavioral1
Sample
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118
Size
57KB
MD5
a7830f2cad12ddff1780a70e9a044753
SHA1
6d4a22cf3e3218d976f3cf6321e4113b2ff1b7dc
SHA256
2d3ca855f9e98bc78ed7c936221d579e7855a421ee811357212f06b224f0f45d
SHA512
ac37b29069403cca6d0e73de1011c41529b6608c57cd84bb5b56c0cb9e94e355660a11d6b47dbeb7cbea23ba7da22038b005b6794d212ae2c8996b255be3d06c
SSDEEP
768:f776wakBZ+BPkRsOBaecI6iDiIcf89IMNnwJigw6uUKQ/gvP8AEqKjojsm1kVXFZ:ff3+pqsvbi2Pf89IMKtjuAk8A0zdZMo
Checks for missing Authenticode signature.
resource |
---|
a7830f2cad12ddff1780a70e9a044753_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentDirectoryA
EnumSystemLanguageGroupsA
ConvertDefaultLocale
GetModuleHandleA
WaitForMultipleObjects
SetEnvironmentVariableA
GetUserDefaultLCID
ConnectNamedPipe
DeleteFileA
OpenThread
InitializeCriticalSection
WriteFile
MapViewOfFile
CreateFileMappingA
GetCurrentProcessId
CreateIoCompletionPort
ReadFile
VirtualQueryEx
GetThreadContext
EnumLanguageGroupLocalesA
GetSystemDefaultUILanguage
GetSystemDefaultLCID
UnmapViewOfFile
GetSystemDefaultLangID
lstrcpynA
InterlockedExchange
CreateFileA
SetFilePointer
WaitNamedPipeA
EnterCriticalSection
CreateNamedPipeA
LeaveCriticalSection
ChildWindowFromPoint
DeleteMenu
GetActiveWindow
GetDC
GetCapture
GetKeyState
SdbReadBYTETagRef
ImmInstallIMEA
DllGetVersion
ILIsEqual
ImmGetIMCCLockCount
RestartDialog
ILAppendID
DAD_DragEnterEx
SdbInitDatabase
ImmGetRegisterWordStyleA
DragQueryPoint
ImmCreateIMCC
ExtractIconExA
Options_RunDLLA
SdbUnregisterDatabase
GetPermLayers
ImmGetHotKey
OpenRegStream
SdbTagToString
SdbGrabMatchingInfo
DllRegisterServer
NetShareEnum
CoCreateInstance
EqualSid
CloseServiceHandle
CloseEncryptedFileRaw
ControlService
SHGetMalloc
SHGetSpecialFolderLocation
CreateProcessNotify
ciphlpr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ