ServiceMain
SvchostPushServiceGlobals
Static task
static1
Behavioral task
behavioral1
Sample
d38ed2d73a29a80beb7ac83ff4be5e5b_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d38ed2d73a29a80beb7ac83ff4be5e5b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d38ed2d73a29a80beb7ac83ff4be5e5b_JaffaCakes118
Size
282KB
MD5
d38ed2d73a29a80beb7ac83ff4be5e5b
SHA1
000151ca1820161ac5237055784ec909589f4e72
SHA256
9f713373125853057d290426ddc91421604c5e544904291cc3f29fc701756ccb
SHA512
5fe813d82822450ae032178f8070447e4eba43b24787aac28056a155be42782e9932304c16eaa69b8c7c6ef01eef2585a6d5521d5a0995cba9c0b29d61d7d758
SSDEEP
6144:KoHZmS2jAy1Iw1q8WLRnawFpJSpsGUGF8rjuZOe63D9lloi:PZmShy1IVLZ67tFCju2D
Checks for missing Authenticode signature.
resource |
---|
d38ed2d73a29a80beb7ac83ff4be5e5b_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
inet_addr
htonl
ntohl
MultiByteToWideChar
WideCharToMultiByte
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
CloseHandle
GetLastError
GetCurrentProcess
Sleep
lstrlenW
lstrlenA
GetTickCount
WaitForSingleObject
CreateMutexW
InitializeCriticalSection
GetVersionExW
CreateThread
GetModuleFileNameW
GetModuleHandleW
CreatePipe
DuplicateHandle
GetEnvironmentStringsW
ReadFile
WriteFile
GetConsoleMode
LoadLibraryW
GetProcAddress
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetNativeSystemInfo
GetThreadLocale
FlushFileBuffers
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetACP
GetLocaleInfoA
LoadLibraryA
GetVersionExA
RaiseException
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetModuleHandleA
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
RtlVirtualUnwind
ExitProcess
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapSetInformation
HeapCreate
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
UnregisterClassA
LoadStringW
EnumServicesStatusW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CoUninitialize
CLSIDFromString
VariantClear
SysAllocStringByteLen
VariantCopy
SysStringLen
VariantChangeType
VariantInit
SysAllocString
SysFreeString
ServiceMain
SvchostPushServiceGlobals
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ