ReflectiveLoader
a
Static task
static1
Behavioral task
behavioral1
Sample
ff20de19c78752343ff3f0670da4950c_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ff20de19c78752343ff3f0670da4950c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ff20de19c78752343ff3f0670da4950c_JaffaCakes118
Size
89KB
MD5
ff20de19c78752343ff3f0670da4950c
SHA1
3871187992eb0fe0fd93c041c30a58b5e953e33c
SHA256
becb04ccb00a2cb6c796d2601d02471932f5393c350456ff22eca2e1e748fa48
SHA512
f346d834610b9183323d2fefb09a5ae00f033ee4c60d1d566a8f6be95db686c041c5af75a888dc3ac34c9f1500fed9e768da9b4b12739cd1611f0c61258e8d82
SSDEEP
1536:4kCfIgAH4TPRcbpf8Ej01Cv7u2FlYz7yv/NXdHY8VwsW4dFnR:4xQnYTybF8Ej01Cv7u2iWv3vFnR
Checks for missing Authenticode signature.
resource |
---|
ff20de19c78752343ff3f0670da4950c_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
GetLastError
CloseHandle
GetHandleInformation
GetProcAddress
LoadLibraryA
CreateEventA
Sleep
WriteFile
SetEvent
WaitForSingleObject
CreateFileA
ExitThread
GetCurrentProcess
ExitProcess
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
MultiByteToWideChar
HeapAlloc
GetModuleHandleExW
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
SetStdHandle
WriteConsoleW
OutputDebugStringW
HeapSize
FlushFileBuffers
CreateFileW
AllocateAndInitializeSid
DuplicateTokenEx
SetThreadToken
OpenProcessToken
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
FreeSid
ReflectiveLoader
a
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ