CoGetComCatalog
GetName
GetRPCSSInfo
ServiceMain
WhichService
_GetName@16
Static task
static1
Behavioral task
behavioral1
Sample
ae9993d1fb2cb9a325443bcb8950e2f1_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
ae9993d1fb2cb9a325443bcb8950e2f1_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ae9993d1fb2cb9a325443bcb8950e2f1_JaffaCakes118
Size
361KB
MD5
ae9993d1fb2cb9a325443bcb8950e2f1
SHA1
03972590b552db1abb206ad4109ce47d77853f6e
SHA256
99d6a2c5e6c591af20e4d2b60f108218167457d778c837cb6f4df526b450b8cd
SHA512
ee4c377b2c8cbc754e23d5a99ec82610f61d503791026d2af8abbede6c095297ed1744c6d77393f0cb3f31c9ae330260c05fffb0a8e664d3856764133c502b94
SSDEEP
768:oI/juLWFzgDQPsB/T30rTahlGW78+Kri+t:nL4QPsB/KTa18+Kri+
Checks for missing Authenticode signature.
resource |
---|
ae9993d1fb2cb9a325443bcb8950e2f1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SizeofResource
FindResourceA
WriteFile
MultiByteToWideChar
lstrlenA
GetProcAddress
LoadLibraryA
ReleaseMutex
GetLastError
VirtualFreeEx
WaitForSingleObject
WriteProcessMemory
VirtualAllocEx
lstrcmpiA
FindClose
FindNextFileA
lstrcpyA
LoadResource
lstrcatA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentProcess
GetCurrentProcessId
CreateFileA
DeleteFileA
MoveFileExA
CopyFileA
GetModuleFileNameA
CreateMutexA
GetModuleHandleA
CloseHandle
FindFirstFileA
Sleep
wsprintfA
RegSetValueExA
RegOpenKeyA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA
RegOpenKeyExA
strncat
free
strstr
_beginthreadex
??2@YAPAXI@Z
memset
CoGetComCatalog
GetName
GetRPCSSInfo
ServiceMain
WhichService
_GetName@16
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ