Protection
UnProtection
Static task
static1
Behavioral task
behavioral1
Sample
fb9dd5917aae3ac3ea39681b62e75032_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
fb9dd5917aae3ac3ea39681b62e75032_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
fb9dd5917aae3ac3ea39681b62e75032_JaffaCakes118
Size
13KB
MD5
fb9dd5917aae3ac3ea39681b62e75032
SHA1
6879d166db0785376eb405b8ab9fb154179f1bdf
SHA256
c8e3e0ba9cfffe359bfc495eb9aa171c16d5691ff775a4f282360586d339f4be
SHA512
12c02b968380bf9521ae73bbaa8e3de8da4dec04c9cd8c2afb430803f0285afc37d54717a4583b09fd7807e0bf2963f5006345aa799137eae6881427a80bcec3
SSDEEP
192:lPI1VEkkEMD6Bqvq5jq1zZldKkEe46xiTNpN5OX/n6cCiEMmKv:lPInEdvq5m1Jtb46xqQOiGKv
Checks for missing Authenticode signature.
resource |
---|
fb9dd5917aae3ac3ea39681b62e75032_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
AddAtomA
CloseHandle
DeleteFileA
FindAtomA
FlushInstructionCache
GetAtomNameA
GetCurrentProcess
GetPrivateProfileStringA
GetProcAddress
LoadLibraryA
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WritePrivateProfileStringA
__dllonexit
_assert
_controlfp
_errno
_iob
_itoa
_ultoa
abort
calloc
exit
fflush
fprintf
free
malloc
mbstowcs
memcpy
memset
realloc
strlen
strtod
wcslen
NtQuerySystemInformation
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
Protection
UnProtection
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ