_KillEverything@4
_StartKilling@8
Static task
static1
Behavioral task
behavioral1
Sample
b25dab4f5b393313f5e445353dc5fa22_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b25dab4f5b393313f5e445353dc5fa22_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
b25dab4f5b393313f5e445353dc5fa22_JaffaCakes118
Size
40KB
MD5
b25dab4f5b393313f5e445353dc5fa22
SHA1
d92e464e8ab01a92a92f0ad080cddda1576cc070
SHA256
7c67afab227fe641bab81424a4b9d18aa5fb9bd6ff22d668d48f6c3693e2a6cf
SHA512
443c19b4f4b058e97fc582f4d9b849ee98e7ee6aef3a6cb8267454d35dffca40815fea3d47605e0648ef173889aee99f1f912dc7fe14ad7d0537284585406226
SSDEEP
768:1HPSogqfTVyjZlyzt/sl9prdwW+jWdhoHwqP5C+H3I7qIuoK6tc4w:JPtgqfTsNlYt/S9ZthoHPPY+4+it5w
Checks for missing Authenticode signature.
resource |
---|
b25dab4f5b393313f5e445353dc5fa22_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RtlNumberGenericTableElements
ExFreePoolWithTag
IoBuildPartialMdl
ExAllocatePool
RtlUpperChar
RtlLookupElementGenericTable
RtlEqualString
IoGetBootDiskInformation
KeClearEvent
RtlCreateHeap
MmMapLockedPages
VerSetConditionMask
RtlFreeHeap
PoUnregisterSystemState
RtlInitUnicodeString
KeSetEvent
RtlDestroyHeap
KeInitializeEvent
RtlInitString
MmBuildMdlForNonPagedPool
RtlCompareString
PoRequestPowerIrp
RtlUnicodeToOemN
RtlUpcaseUnicodeToOemN
PoSetPowerState
IoWritePartitionTableEx
RtlAllocateHeap
KeWaitForSingleObject
IoSetPartitionInformationEx
FsRtlAllocateFileLock
memset
_KillEverything@4
_StartKilling@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ