Always
CallByControl
Downing
FKingSoft
GetPlayerVersion
KingS
Stop
playAda
Static task
static1
Behavioral task
behavioral1
Sample
f026e734347be4586e5e10a6a967a45e_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f026e734347be4586e5e10a6a967a45e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
f026e734347be4586e5e10a6a967a45e_JaffaCakes118
Size
219KB
MD5
f026e734347be4586e5e10a6a967a45e
SHA1
8a2f288d37302e67363bae2a2dee31c0165f56ac
SHA256
638ca6356940f912bfd879bb0c9de66d6b970fff9905d441c1f2a982ae28b368
SHA512
9d1d10d8c6f9a624684369036cf11c5cb88c95cd080ce9c489887ca88bec21d85f3730cdcbc2b37cc7777889920b732d3f83a23b48aab636f4eb3b9d449eb82e
SSDEEP
3072:vYcHZsLkR1crGEFiqY377X2A/Z/1qsz8NxmBsrbDsecJ87ThGdd11BRsDKHT4nXL:VxR1caEFa32G1qBNxmBgDzGdd9R6rS2
Checks for missing Authenticode signature.
resource |
---|
f026e734347be4586e5e10a6a967a45e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
WSACleanup
CoTaskMemFree
InternetReadFile
URLDownloadToFileA
GetForegroundWindow
DeleteObject
RegQueryValueExA
SHGetFolderPathA
SysAllocString
Always
CallByControl
Downing
FKingSoft
GetPlayerVersion
KingS
Stop
playAda
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE