_KillEverything@4
_StartKilling@8
Static task
static1
Behavioral task
behavioral1
Sample
aa1c288d204a901d15196201ee40876a_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
aa1c288d204a901d15196201ee40876a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
aa1c288d204a901d15196201ee40876a_JaffaCakes118
Size
40KB
MD5
aa1c288d204a901d15196201ee40876a
SHA1
f96ab06bdd15436a7a6b2a66e09986e3c8251e68
SHA256
f6a0d8eaab95c44b7243233a9a5792d0d92631c95a32533f1324c779b49968d1
SHA512
102caa402d6c5bb06ac7d0691b920b823a7288b5c421a2eaf180ff5d5ab11685e4880d92d951f07d2b7b57928464cea8246f450d26443798da4c5f64c5ea3309
SSDEEP
768:kHPSogqf83HmIhyyvx4W3fEs2k9OAbS8O7MaDX6x5lB0ekDsaw:GPtgqf8VCW8FkJbS8YMaLi5l2Dsaw
Checks for missing Authenticode signature.
resource |
---|
aa1c288d204a901d15196201ee40876a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RtlNumberGenericTableElements
ExFreePoolWithTag
IoBuildPartialMdl
ExAllocatePool
RtlUpperChar
RtlLookupElementGenericTable
RtlEqualString
IoGetBootDiskInformation
KeClearEvent
RtlCreateHeap
MmMapLockedPages
VerSetConditionMask
RtlFreeHeap
PoUnregisterSystemState
RtlInitUnicodeString
KeSetEvent
RtlDestroyHeap
KeInitializeEvent
RtlInitString
MmBuildMdlForNonPagedPool
RtlCompareString
PoRequestPowerIrp
RtlUnicodeToOemN
RtlUpcaseUnicodeToOemN
PoSetPowerState
IoWritePartitionTableEx
RtlAllocateHeap
KeWaitForSingleObject
IoSetPartitionInformationEx
FsRtlAllocateFileLock
memset
_KillEverything@4
_StartKilling@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ