AppCleanup
capCreateCaptureWindowA
capCreateCaptureWindowW
capGetDriverDescriptionA
Behavioral task
behavioral1
Sample
b339de31fef20345c77f538dfd20558b_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b339de31fef20345c77f538dfd20558b_JaffaCakes118
Size
148KB
MD5
b339de31fef20345c77f538dfd20558b
SHA1
7a7b8d942beb9627c4966c68ce31d60838235981
SHA256
fa16ccef3b2253cc89d4398bf91845ddfdecd6e63b63fddbc512dc2e0d1e12fd
SHA512
2fc6a482b795934cea7adf95bd04b56a3d4a3f2fff7cbaa63d68df20c78dabd957b12ebe53acd4a256e2870498aec130a2c1eeb9d61a8bd57d07987b5b882191
SSDEEP
3072:UWaPdObHUgryKt8hxGyrnuC2H8i6hSTTgBTBftgN9KH:Fb0QdGhxGy6f6hSTEBTBlgN9KH
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
b339de31fef20345c77f538dfd20558b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetClassNameA
GetWindow
ShowWindow
EnableWindow
LoadCursorA
DestroyCursor
GetCursorInfo
CloseWindowStation
CreateWindowExA
DestroyWindow
MessageBoxA
wvsprintfA
wsprintfA
GetTempPathA
RaiseException
ExpandEnvironmentStringsA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
WideCharToMultiByte
LocalReAlloc
LocalSize
IsBadStringPtrW
IsBadReadPtr
ExitThread
RemoveDirectoryA
DeleteFileA
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
CloseHandle
InterlockedExchange
Sleep
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetTickCount
lstrlenA
lstrcatA
GetLocalTime
HeapFree
GetProcessHeap
MapViewOfFile
GetLastError
CreateFileMappingA
HeapAlloc
lstrcpyA
LocalFree
LocalAlloc
GetModuleFileNameA
SetUnhandledExceptionFilter
FormatMessageA
GetModuleHandleA
VirtualQuery
IsBadWritePtr
GetSystemDirectoryA
FreeLibrary
GetProcAddress
GetCurrentProcessId
GetCurrentThreadId
GetShortPathNameA
GetFileAttributesExA
lstrcmpA
lstrcmpiA
MultiByteToWideChar
SetEnvironmentVariableA
LoadLibraryA
GetCurrentProcess
GetLongPathNameA
ExitProcess
GetSystemInfo
GetVersionExA
GetProcessTimes
GlobalMemoryStatusEx
GetTempFileNameA
srand
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_memicmp
_strupr
_stricmp
_strlwr
_wcsicmp
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
??2@YAPAXI@Z
__CxxFrameHandler
_except_handler3
wcsrchr
realloc
malloc
rand
_beginthreadex
strncpy
_CxxThrowException
free
atoi
strchr
wcstombs
strncat
wcslen
strrchr
AppCleanup
capCreateCaptureWindowA
capCreateCaptureWindowW
capGetDriverDescriptionA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ