ServiceRouteEx
StartServiceEx
StopServiceEx
Static task
static1
Behavioral task
behavioral1
Sample
eab5d6ca956b75320daaf3aecc2c8468_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eab5d6ca956b75320daaf3aecc2c8468_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
eab5d6ca956b75320daaf3aecc2c8468_JaffaCakes118
Size
16KB
MD5
eab5d6ca956b75320daaf3aecc2c8468
SHA1
2dd68f5c93324a8ded04018743571daeda94adff
SHA256
9267f69a0f6754cfa5417de5dc3fbb2520af78030db3c3c8c644edcd4d2bb792
SHA512
127474b827d167d6d8e0133acb9a6812eb861dd2e2c2debdf41eb3de82d9a6b5d4ef99e393f18460b723a77811e91b88c86fbcd27c405f55504a36d5ce6b0aad
SSDEEP
192:ZWMHvcbSWObklOzx62+3lwDjMuBBQ6PRQkmwmqdsw+A4Jay:EMHvcHkkibwl6jMuBBQARQkm2dsVnZ
Checks for missing Authenticode signature.
resource |
---|
eab5d6ca956b75320daaf3aecc2c8468_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
sscanf
atoi
strstr
strlen
memcpy
memcmp
RtlZeroMemory
gethostname
lstrcatA
ReadProcessMemory
OpenProcess
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcessId
EnterCriticalSection
DeleteCriticalSection
IsBadReadPtr
lstrcpyA
lstrcmpiA
WaitForSingleObject
TerminateThread
CloseHandle
CreateFileA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
LoadLibraryA
ReadFile
VirtualProtectEx
CreateThread
lstrlenA
Sleep
wsprintfA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
ServiceRouteEx
StartServiceEx
StopServiceEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ