__KeRemoveQueue@4
__KeRemoveQueueEx@0
__KeRundownQueue@4
Static task
static1
Behavioral task
behavioral1
Sample
e0a32b3580bb891e6a5af4dce6f6809a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
e0a32b3580bb891e6a5af4dce6f6809a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
e0a32b3580bb891e6a5af4dce6f6809a_JaffaCakes118
Size
33KB
MD5
e0a32b3580bb891e6a5af4dce6f6809a
SHA1
671da28a097e9b7610038f917c09331c96088e45
SHA256
d0217099a78302887ba4a86e4c8e4ddd8637e7c9f9314c6903fbac8f685bc492
SHA512
99f1ca47de4dd4fb20175192e77c225a4e16c47616bcb8442e2e7ea469dc170f0e0e64502873a9ff1626ffa87bc61910d880c22b71e9d2dd4f22dbcefef43b5d
SSDEEP
768:F+j+xwc5taWYilfGbaxD217QDZ/PkC6vkk+U9WIiTfb:F+PciilfG2xDk7+Z/PCvJx0
Checks for missing Authenticode signature.
resource |
---|
e0a32b3580bb891e6a5af4dce6f6809a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeLockSubjectContext
SeReleaseSubjectContext
SeCaptureSubjectContext
MmIsDriverVerifying
SeUnlockSubjectContext
VerSetConditionMask
IoGetRelatedDeviceObject
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
_wcslwr
ZwOpenDirectoryObject
ZwSetEvent
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
wcsspn
DbgPrintEx
RtlInitializeGenericTable
memset
__KeRemoveQueue@4
__KeRemoveQueueEx@0
__KeRundownQueue@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ