CCenter
Rool
ServiceMain
whm
Behavioral task
behavioral1
Sample
a9ed5aa115408a97211160a5395d14d1_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a9ed5aa115408a97211160a5395d14d1_JaffaCakes118
Size
59KB
MD5
a9ed5aa115408a97211160a5395d14d1
SHA1
a2d4a023e11d1808dd011633056145e0de93ca2e
SHA256
7c5e812eeca59fe5537ff8b6f995b4367742cb6c03e313b20df622f0ac23ce78
SHA512
85b9065bf825a804ff599707e29855116e80f09839c83e28960a2cf2420f6ee83773268043a32c364193173ba24d365ae85cae14410f97b6e810bb040f3b30f9
SSDEEP
1536:TqPXxuO+1vDOLPFFcuhPfLRQxxOQ846T1:EXS1vDsdF5h3LRQeQ846T1
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
a9ed5aa115408a97211160a5395d14d1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
GlobalFree
GlobalAlloc
SizeofResource
HeapFree
DeviceIoControl
LoadLibraryExA
GetModuleHandleA
SetFileAttributesA
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
GetCurrentThreadId
GetTickCount
FindResourceA
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
GetLastError
DeleteFileA
GetProcAddress
FreeLibrary
lstrcatA
lstrlenA
Sleep
CancelIo
InterlockedExchange
lstrcpyA
ResetEvent
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
SetEvent
WaitForSingleObject
CloseHandle
LoadResource
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
wsprintfA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
ControlService
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
_strnicmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
atoi
realloc
strncat
strncpy
_except_handler3
free
malloc
strchr
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
send
select
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
ntohs
recv
closesocket
WSAStartup
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
CCenter
Rool
ServiceMain
whm
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ