EnHookWindow
UninstallHook
sub_getmessage
sub_keyboard
sub_mouse
Static task
static1
Behavioral task
behavioral1
Sample
ded6fea5eaca0173113d7bb8a652e945_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ded6fea5eaca0173113d7bb8a652e945_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ded6fea5eaca0173113d7bb8a652e945_JaffaCakes118
Size
610KB
MD5
ded6fea5eaca0173113d7bb8a652e945
SHA1
290eb2ff7adf030d4e985de26a89d15c48684eff
SHA256
08288a94a7ba651f829746537b998291e1401ae1eea66bf3ce660ad76ad32e13
SHA512
5fbf12cc35cc57d01efe41bbc6ff3e5071fd688a7be1db63b556f6cdd41f809af289f7c5158ff1b696fe67c71f65d334db14d1dcdd95baf387c5668ce963a618
SSDEEP
12288:UBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmBh/:UBhmBhmBhmBhmBhmBhmBhmBhmBhmBhmr
Checks for missing Authenticode signature.
resource |
---|
ded6fea5eaca0173113d7bb8a652e945_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetMessageA
wsprintfA
CloseHandle
CreateFileA
CreateThread
DisableThreadLibraryCalls
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetSystemDirectoryA
GlobalAlloc
LoadLibraryA
ReadFile
RtlMoveMemory
RtlZeroMemory
SetFileAttributesA
SetFilePointer
Sleep
TerminateProcess
VirtualProtectEx
WideCharToMultiByte
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpyA
lstrlenA
RegQueryValueExA
EnHookWindow
UninstallHook
sub_getmessage
sub_keyboard
sub_mouse
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ