_KillEverything@4
_StartKilling@8
Static task
static1
Behavioral task
behavioral1
Sample
bc8494e8b5458e0f53f454fbcd15450c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bc8494e8b5458e0f53f454fbcd15450c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
bc8494e8b5458e0f53f454fbcd15450c_JaffaCakes118
Size
40KB
MD5
bc8494e8b5458e0f53f454fbcd15450c
SHA1
4e631962a4b06424d8799ce82f6213d26c9b338a
SHA256
bbd14bf9fb6d6467390ef11e1f08186e774917b8b0f0aba209243a81ced6e1f2
SHA512
3751b0a6718dca19593f9b9cfeb02c6ffd2ce89ff399d5ac89ebad2f225448f15df883d0220277cc214ec43e8db4ebae65aa8437442df90734591e5d5286141a
SSDEEP
768:LHPSogqfwVyjZlyzt/sl9prdwW+jWdhoHwqP5C+H3I7qIuoK6tcFw:bPtgqfwsNlYt/S9ZthoHPPY+4+it8w
Checks for missing Authenticode signature.
resource |
---|
bc8494e8b5458e0f53f454fbcd15450c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RtlNumberGenericTableElements
ExFreePoolWithTag
IoBuildPartialMdl
ExAllocatePool
RtlUpperChar
RtlLookupElementGenericTable
RtlEqualString
IoGetBootDiskInformation
KeClearEvent
RtlCreateHeap
MmMapLockedPages
VerSetConditionMask
RtlFreeHeap
PoUnregisterSystemState
RtlInitUnicodeString
KeSetEvent
RtlDestroyHeap
KeInitializeEvent
RtlInitString
MmBuildMdlForNonPagedPool
RtlCompareString
PoRequestPowerIrp
RtlUnicodeToOemN
RtlUpcaseUnicodeToOemN
PoSetPowerState
IoWritePartitionTableEx
RtlAllocateHeap
KeWaitForSingleObject
IoSetPartitionInformationEx
FsRtlAllocateFileLock
memset
_KillEverything@4
_StartKilling@8
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ