EjectDllA
EjectDllW
GetProcessInfo
InjectDllA
InjectDllW
RemoteExecute
StartRemoteSubclass
StopRemoteSubclass
Static task
static1
Behavioral task
behavioral1
Sample
ada6168fb01de8396d8a4909a1810d71_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
ada6168fb01de8396d8a4909a1810d71_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ada6168fb01de8396d8a4909a1810d71_JaffaCakes118
Size
108KB
MD5
ada6168fb01de8396d8a4909a1810d71
SHA1
b1422d76d1bbf1df0cc8eeb50ea48cc666f105a0
SHA256
bd54b71c87ee7e5c1594d2bfe9d10ba09431dab944885bc8286892e0e8eaee13
SHA512
133b797f807e927a157fd4f94df52a1a51c288cfb0ac4f31ae3b3d542e7ba56b2d05677c5c4c1fcbbd5f7b251d9cfe5e3fd36addf6ee19ff79ff2732c87d6861
SSDEEP
1536:ONUy4OUIMWXG1JGhTJSk4TzBoIpqIfYH0Lh7v8H1jkEfAZoephEjxPtReohgqUg:ONFz5HksH0zBoIpquJhs1fResj5lH5
Checks for missing Authenticode signature.
resource |
---|
ada6168fb01de8396d8a4909a1810d71_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapReAlloc
LoadLibraryA
CloseHandle
ReadProcessMemory
OpenProcess
WriteProcessMemory
GetExitCodeThread
SetLastError
WaitForSingleObject
GetCurrentThread
GetProcAddress
lstrcpyA
WideCharToMultiByte
DisableThreadLibraryCalls
GetVersionExA
IsBadReadPtr
GetCurrentProcessId
VirtualAlloc
VirtualFree
GetCurrentProcess
DuplicateHandle
GetCurrentThreadId
ResumeThread
GetThreadContext
GetStdHandle
GetFileType
RtlUnwind
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
HeapDestroy
HeapCreate
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FreeLibrary
TerminateProcess
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetCPInfo
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
IsWindowUnicode
EjectDllA
EjectDllW
GetProcessInfo
InjectDllA
InjectDllW
RemoteExecute
StartRemoteSubclass
StopRemoteSubclass
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ