Qy001DoMainWssk
Qy001Service
ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
db1f8468238b42b74e34729e2c53efd0_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
db1f8468238b42b74e34729e2c53efd0_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
db1f8468238b42b74e34729e2c53efd0_JaffaCakes118
Size
131KB
MD5
db1f8468238b42b74e34729e2c53efd0
SHA1
e9f41685e290aab9ef94686ac9a7b01064416923
SHA256
012c554cd6e3ec1f0f122b32a20a270b4dea29887de6a4df9b49a8d6eb9c615a
SHA512
d14b6d00318b580a3fadf1575ad5e3364747855772b943dc92242d74b125d9db31e44f578e90c4cc8fb1be28e6214f2b5fa3dc7dbd2f42e62b514aff611a4909
SSDEEP
3072:uStgpPOWSCO5W21179UVAAFitfn3YzCqrKuRFKFcI:ptG3SxJUVAozPKi
Checks for missing Authenticode signature.
resource |
---|
db1f8468238b42b74e34729e2c53efd0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExitWindowsEx
GetDIBits
RegCloseKey
ShellExecuteA
CreateStreamOnHGlobal
listen
StrRChrA
GetModuleFileNameExA
ImmReleaseContext
capCreateCaptureWindowA
waveInUnprepareHeader
strrchr
OpenProcess
GetModuleHandleA
GetProcAddress
VirtualProtect
Qy001DoMainWssk
Qy001Service
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ