SetDIPSHook
startNow
Behavioral task
behavioral1
Sample
b0bab9e8cc583bf10cfb9d4c39ed773e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b0bab9e8cc583bf10cfb9d4c39ed773e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
b0bab9e8cc583bf10cfb9d4c39ed773e_JaffaCakes118
Size
167KB
MD5
b0bab9e8cc583bf10cfb9d4c39ed773e
SHA1
0b5765be79fb73b10f2360115deab208675950cc
SHA256
3ed605d0450441d1db570870b405288afa70a64caacc8f615e48a12c3032fd5e
SHA512
c840a73c7b965829a8cea9d57efe468b16673d81ff719ecf86f1746bd1c2664ec860bab86c46c5edb73e6eb6eaf9ce6594527dbdd8655d9d2eff087bd4d11938
SSDEEP
1536:Rk9gm6oJZ1/Grj4S2DBxiF30i6CWQ/cA+Vynum:RkqmHkH4ZGNL6DTVynum
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b0bab9e8cc583bf10cfb9d4c39ed773e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
Beep
UnmapViewOfFile
MapViewOfFile
CloseHandle
OpenFileMappingA
GetCurrentThreadId
GetLocalTime
DeleteFileA
SetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
memmove
fopen
system
_itoa
_beginthread
malloc
_initterm
_adjust_fdiv
_onexit
__dllonexit
free
strcpy
fwrite
memset
strcat
strstr
strlen
sprintf
_splitpath
fread
strcmp
_strlwr
fclose
IsWindow
GetWindowTextA
PostThreadMessageA
FindWindowA
GetWindowLongA
SendMessageA
EnumWindows
GetClassNameA
EnumChildWindows
MessageBoxA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetWindowThreadProcessId
SetDIPSHook
startNow
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE