__KeRemoveQueue@4
__KeRemoveQueueEx@0
__KeRundownQueue@4
Static task
static1
Behavioral task
behavioral1
Sample
0c988bad4680f97763b8b2374a7a246b_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0c988bad4680f97763b8b2374a7a246b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
0c988bad4680f97763b8b2374a7a246b_JaffaCakes118
Size
33KB
MD5
0c988bad4680f97763b8b2374a7a246b
SHA1
baa4ad5d3e5b01eba6d906a6c525d1914c61eabd
SHA256
76c1cdf6c0a5cd413f9d953f13bf572455a83a96bd591715ded3df499ca99a25
SHA512
926915690c2e9ead98fd0fb347b2de3879edb9c38614c1ac6df31ee934a23e2a565d55b8d4140cb14d3f994c4a5fd86e0261d094035372a359230e09ee310f50
SSDEEP
768:4+D9qHfMc03YunYR/dcCwdoxZ8rA/8/PmTf:4+AH0wcQxZ8rAKS
Checks for missing Authenticode signature.
resource |
---|
0c988bad4680f97763b8b2374a7a246b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SeLockSubjectContext
SeReleaseSubjectContext
SeCaptureSubjectContext
MmIsDriverVerifying
SeUnlockSubjectContext
VerSetConditionMask
IoGetRelatedDeviceObject
RtlUnicodeStringToAnsiString
RtlInsertElementGenericTableFull
RtlInitString
RtlDeleteElementGenericTable
RtlCompareString
_wcslwr
ZwOpenDirectoryObject
ZwSetEvent
_vsnwprintf
RtlFreeAnsiString
RtlCopyString
RtlEqualString
strrchr
KeTickCount
wcsspn
DbgPrintEx
RtlInitializeGenericTable
memset
__KeRemoveQueue@4
__KeRemoveQueueEx@0
__KeRundownQueue@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ