CancelDll
LoadDll
Static task
static1
Behavioral task
behavioral1
Sample
ebc4565bd8edb58156a332f41bae8c4a_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ebc4565bd8edb58156a332f41bae8c4a_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ebc4565bd8edb58156a332f41bae8c4a_JaffaCakes118
Size
100KB
MD5
ebc4565bd8edb58156a332f41bae8c4a
SHA1
440c47d614b196a9433c9d80369bcbdddde3f5e7
SHA256
b63137f77f573447905c889fd6ffbcd8dbc450a6666e0dcfb4d4d118c374c566
SHA512
c17eb5de42e21f72fb0273edd1b476c71427870fe8061cdd2bcffa0e62532971e3c3962fab6053d64fb88bc027a773454755dca2331c33087754ddf3ca9ed2f1
SSDEEP
3072:pH6lIZShbO5WgTKukIpR1zRJdaPsUGG8w:pFZRWgTKlIpRpRJgPsTG8w
Checks for missing Authenticode signature.
resource |
---|
ebc4565bd8edb58156a332f41bae8c4a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
time
srand
rand
_vsnprintf
tolower
strrchr
_except_handler3
malloc
strncpy
free
atoi
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
strlen
sprintf
memset
_strcmpi
lstrlenA
MultiByteToWideChar
CreateToolhelp32Snapshot
Thread32First
GetCurrentProcessId
OpenThread
GetThreadContext
SetThreadContext
Thread32Next
EnterCriticalSection
LeaveCriticalSection
IsBadReadPtr
HeapAlloc
GetProcessHeap
Sleep
LoadLibraryA
GetComputerNameA
CloseHandle
GetFileSize
ReadFile
SetFilePointer
GetProcAddress
GetModuleHandleA
AddVectoredExceptionHandler
VirtualProtect
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
wsprintfA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CancelDll
LoadDll
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE