ServiceRouteEx
StartServiceEx
StopServiceEx
Static task
static1
Behavioral task
behavioral1
Sample
f698cf643e188170b31b5ab736d81c09_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f698cf643e188170b31b5ab736d81c09_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
f698cf643e188170b31b5ab736d81c09_JaffaCakes118
Size
16KB
MD5
f698cf643e188170b31b5ab736d81c09
SHA1
b5077eec0605f4a47888523784d694c98d8e666d
SHA256
d5e7a14f4db73967ffe37fac4ec57f4b1ff9fcf450b0bd54853c8dddd27617f4
SHA512
c3621a8b154fd9399b806a6e929cd95b3ce73dcdb50e6ecaffc7e4bfe986cb2425c5ea5111a54a179115fe1cfc290a4e7f405c1d58be055100814dc4eede1661
SSDEEP
192:em+K5a3uyWBojWQVukvdW0wDe9uBBQ6PRQkPDpfl4Amq:eNK5a3MYVVW06e9uBBQARQkLpf+
Checks for missing Authenticode signature.
resource |
---|
f698cf643e188170b31b5ab736d81c09_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
sscanf
atoi
strstr
strlen
memcpy
memcmp
RtlZeroMemory
gethostname
ReadFile
ReadProcessMemory
OpenProcess
GetCurrentProcessId
CreateThread
lstrlenA
lstrcatA
VirtualProtectEx
IsBadReadPtr
lstrcpyA
lstrcmpiA
WaitForSingleObject
TerminateThread
CloseHandle
CreateFileA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
LoadLibraryA
Sleep
wsprintfA
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
EnumWindows
GetWindowTextA
GetWindowThreadProcessId
ServiceRouteEx
StartServiceEx
StopServiceEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ