Hook
Unhook
Static task
static1
Behavioral task
behavioral1
Sample
d6f38b70e5e8f9c47b3d67a0f532a08e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d6f38b70e5e8f9c47b3d67a0f532a08e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d6f38b70e5e8f9c47b3d67a0f532a08e_JaffaCakes118
Size
28KB
MD5
d6f38b70e5e8f9c47b3d67a0f532a08e
SHA1
f94bbc6ed0ea1d96bc0b2695891b8e38c147fe9c
SHA256
09f357e017cb3d6abca4b0d27297242dc9a611bf82e618341c57a9f1add23536
SHA512
5a4ea6806519c1b0515bb297e81c0f9d16df96973df57aa685df403417987296ed674ee7c4bb0f9e66c07eb55c0b61b3c69b6ec7e65017e55b4eaf96d1b077cc
SSDEEP
96:mG4vj0ixoDeP8c2Pjnu0agnKkvR3HuCDuvUeIwWoApB9QhXFWCzk+Qbw/:fSj0ixoy89LMNkJeCDKJjWo8QhtYJw/
Checks for missing Authenticode signature.
resource |
---|
d6f38b70e5e8f9c47b3d67a0f532a08e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleHandleA
GetSystemInfo
SetThreadPriority
CloseHandle
Module32Next
Module32First
CreateToolhelp32Snapshot
GetCurrentThread
GetProcAddress
GetCurrentProcessId
WriteProcessMemory
GetCurrentProcess
VirtualProtectEx
lstrcmpiA
LoadLibraryA
LoadLibraryW
LoadLibraryExA
DisableThreadLibraryCalls
VirtualQuery
LoadLibraryExW
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
ImageDirectoryEntryToData
__CxxFrameHandler
__dllonexit
_adjust_fdiv
malloc
_except_handler3
??3@YAXPAX@Z
??2@YAPAXI@Z
_onexit
free
_initterm
Hook
Unhook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ