SetDIPSHook
Start
Static task
static1
Behavioral task
behavioral1
Sample
00c57ff80f8b1636f448e151dd4401cf_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
00c57ff80f8b1636f448e151dd4401cf_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
00c57ff80f8b1636f448e151dd4401cf_JaffaCakes118
Size
40KB
MD5
00c57ff80f8b1636f448e151dd4401cf
SHA1
879d7b5915c6b6e7e07ca7051c214377f74a94cf
SHA256
ca12cc09ec6ec556d64e04c0e5303d8fcfda504453ecc7c9132322826305dbe0
SHA512
6471d33071186429e8ac123b82ba1c28f3bf97f0dd1e69210487b26f5f1cdda38638c898c870697518c1af82f88a467a7676e7a92937e876f01cbc8a0377f94c
SSDEEP
384:qo6H1mB/4GsI8l3bdhfrA+0GknIUW8ZfEtwixmVxwqT9fiX0+fbAzdnaA4ol97Oy:EVmGhDUs0EtrmzViG5aHoLOzipyf
Checks for missing Authenticode signature.
resource |
---|
00c57ff80f8b1636f448e151dd4401cf_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
getsockname
gethostname
gethostbyname
recv
WSACleanup
socket
ioctlsocket
closesocket
htons
inet_addr
connect
setsockopt
WSAStartup
send
select
inet_ntoa
RegOpenKeyExA
RegQueryInfoKeyA
GetUserNameA
RegQueryValueExA
StartServiceA
ControlService
ChangeServiceConfigA
OpenSCManagerA
EnumServicesStatusA
OpenServiceA
QueryServiceConfigA
CloseServiceHandle
RegCreateKeyExA
RegDeleteKeyA
OpenProcessToken
RegSetValueExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
ShellExecuteA
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
PostThreadMessageA
_findclose
strncmp
fopen
_findnext
fwrite
atoi
strncpy
memmove
_findfirst
sprintf
atol
__CxxFrameHandler
malloc
_msize
??3@YAXPAX@Z
_initterm
_adjust_fdiv
fseek
fread
free
fclose
realloc
strstr
_strnicmp
DeleteFileA
SetFileAttributesA
GetSystemDirectoryA
GetVersionExA
FreeLibrary
GetProcAddress
LoadLibraryA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
TerminateProcess
OpenProcess
GetVersion
GetSystemInfo
CreateFileMappingA
GetLogicalDrives
GetDriveTypeA
FreeLibraryAndExitThread
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
GetCurrentThreadId
TerminateThread
CloseHandle
GetModuleFileNameA
Sleep
GetCurrentThread
CreateThread
SetDIPSHook
Start
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ