ServiceRouteEx
StartServiceEx
StopServiceEx
ruixing
ruixing2
ruixing3
Static task
static1
Behavioral task
behavioral1
Sample
ba4db29ae866b42e13a74c3728b5d747_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ba4db29ae866b42e13a74c3728b5d747_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ba4db29ae866b42e13a74c3728b5d747_JaffaCakes118
Size
28KB
MD5
ba4db29ae866b42e13a74c3728b5d747
SHA1
9d9ebbc1bfacb91d67bc55e22d6074df663e5eb3
SHA256
16ad769ef7f8ac7861d74c5812a890822acb172e350b3dc1e56ccb59d607992e
SHA512
b64e3d8685172f4773d11d022c467d1275d2b0585363e4b1794e0431949b8d36eb30287afaa6b9d9c098f4afe297f7e146832d8b0b0eb7774107ebcc198ccc63
SSDEEP
384:Ixi0PRtXTXUf/prq6fuBBQARQkubxPz9a73E5at:IJRtXT6+6GBBQARQkSxPzoE5
Checks for missing Authenticode signature.
resource |
---|
ba4db29ae866b42e13a74c3728b5d747_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetEvent
WriteProcessMemory
WaitForSingleObject
MultiByteToWideChar
GetCurrentDirectoryA
ReadProcessMemory
GetProcAddress
LoadLibraryA
CreateEventA
lstrlenA
Sleep
WideCharToMultiByte
lstrcatA
VirtualProtect
CloseHandle
CreateThread
GetModuleFileNameA
CallNextHookEx
wsprintfA
SetTimer
KillTimer
SetWindowsHookExA
UnhookWindowsHookEx
gethostname
send
InternetCloseHandle
InternetOpenA
InternetReadFile
InternetOpenUrlA
GetAdaptersInfo
_adjust_fdiv
malloc
_initterm
free
strrchr
strcmp
fopen
fputs
fread
fclose
memcmp
strlen
memset
strcpy
strcat
_strlwr
_itoa
ServiceRouteEx
StartServiceEx
StopServiceEx
ruixing
ruixing2
ruixing3
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ