Rool
httsl
libra
ress
whm
Behavioral task
behavioral1
Sample
d44e279f96abd613d0265d0d27253379_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d44e279f96abd613d0265d0d27253379_JaffaCakes118
Size
55KB
MD5
d44e279f96abd613d0265d0d27253379
SHA1
c9c1b55353f10f58763ade2ac436d4021cacd652
SHA256
1a4b8e10fb92fb20be8b8b1efc163d10e2955e23a51836a27faffcc39517536a
SHA512
d706460c5adcf6a9aa3e5b106df8643c92c57e72f598c509fd585d4c7ac177486883f6dd29144a081153ec2e4f236458a1a188e2b193d10e44b7882cb7e6d524
SSDEEP
768:YbQfk0L8sGc+ZLhRhLDE6fkQSmtxP31Aoqq3U2lk/yr9aUpo:Ycfk02cqhHfkQSmXSI1a
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
d44e279f96abd613d0265d0d27253379_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
WriteFile
GetSystemDirectoryA
GetTickCount
MoveFileA
MoveFileExA
TerminateThread
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
CreateProcessA
SetLastError
GetModuleFileNameA
CreateFileA
SetFilePointer
ReadFile
InitializeCriticalSection
lstrlenA
DeleteFileA
Sleep
CancelIo
InterlockedExchange
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
FreeConsole
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
SetProcessWindowStation
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
SHDeleteKeyA
free
_strnicmp
_strcmpi
calloc
_beginthreadex
wcstombs
atoi
realloc
strchr
strncat
malloc
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_except_handler3
strncpy
strrchr
setsockopt
closesocket
select
ntohs
gethostname
getsockname
connect
socket
gethostbyname
htons
send
WSAIoctl
WSACleanup
WSAStartup
recv
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile
capGetDriverDescriptionA
Rool
httsl
libra
ress
whm
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ