ZtGame_IN
ZtGame_OUT
Behavioral task
behavioral1
Sample
bb0c2f17da47c57a8f521ab175eb79c3_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bb0c2f17da47c57a8f521ab175eb79c3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
bb0c2f17da47c57a8f521ab175eb79c3_JaffaCakes118
Size
34KB
MD5
bb0c2f17da47c57a8f521ab175eb79c3
SHA1
2c409fbe9c0818793f6e52fa6ea576720854c055
SHA256
68d0fbb45052bd5ebf306ad8817fdd7db0d7e574b5d22d2c1b2faee67f0457b3
SHA512
2033056a296ee8df0c624ac49ccb6ec6ecc008bac9326d6fd9d53421f3b2e53fe8c7777100d46a09110c989b193b8414a2d09ceeb6e818a5fe80273ec57c7624
SSDEEP
384:ntiIBkRo4yvbblI8GZ+8+24ngwC/PKzJHnfC/s:nkIBqbyvm8GZ+O43/y
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bb0c2f17da47c57a8f521ab175eb79c3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentThreadId
CloseHandle
CreateProcessA
GetTempPathA
Sleep
WriteProcessMemory
VirtualProtectEx
ReadProcessMemory
GetCurrentProcess
LoadLibraryA
GetCommandLineA
CreateThread
GetModuleHandleA
GetPrivateProfileStringA
GetModuleFileNameA
GetLastError
GetTickCount
GetProcAddress
VirtualFree
GetVersionExA
VirtualAlloc
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
wsprintfA
ToAscii
GetKeyboardState
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetMessageA
PostThreadMessageA
GetInputState
GetAsyncKeyState
ZtGame_IN
ZtGame_OUT
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE