FUCC
RMain
ServiceMain
Behavioral task
behavioral1
Sample
cefdc558cd73cbeb053b2b75dab9d28f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cefdc558cd73cbeb053b2b75dab9d28f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
cefdc558cd73cbeb053b2b75dab9d28f_JaffaCakes118
Size
44KB
MD5
cefdc558cd73cbeb053b2b75dab9d28f
SHA1
d2a095d627c0c250c98728d37b7e5a6b7c5572e3
SHA256
f1dd1af7fb004d88f7ead15e074634cec634272b0c23a6733e72cd4d40fd7226
SHA512
33105d50c79b0f4665ec4f0664963d2489a6f7cc57491e98e4e81220f68313bc31246cf71316d3a449946db277cc80400f9ff24c0483f8e8ee8fd08ed5810710
SSDEEP
384:IWtQMMV2dwnJ9EGZeSICsm+x4VHTuDc96q/oA5SApjuxZ:ZyMu2d6JGTYVVHTuLA5l4Z
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
cefdc558cd73cbeb053b2b75dab9d28f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleHandleA
VirtualFree
CreateThread
VirtualAlloc
GetProcAddress
SuspendThread
ResumeThread
OpenThread
lstrcpyA
lstrlenA
ExitProcess
GetModuleInformation
??3@YAXPAX@Z
memmove
ceil
_ftol
__CxxFrameHandler
??2@YAPAXI@Z
_beginthreadex
realloc
free
wcstombs
strncpy
_access
malloc
_initterm
_adjust_fdiv
_stricmp
WTSQueryUserToken
FUCC
RMain
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ