COMResModuleInstance
DeleteSelf
wwhkf
wwhko
Static task
static1
Behavioral task
behavioral1
Sample
0ac6a4873b8c285e41e047606ec2f8ac_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0ac6a4873b8c285e41e047606ec2f8ac_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
0ac6a4873b8c285e41e047606ec2f8ac_JaffaCakes118
Size
18KB
MD5
0ac6a4873b8c285e41e047606ec2f8ac
SHA1
e9ed09ef4bdf8a5a0172abd1258da34f9a87976a
SHA256
0634ff60a67f8a9e1ab287e547e97ddccef8498af2a4cb2875c83d5eae35e3f2
SHA512
71ac4f4f70c5f99402b39f0be5adcd6f0469d69e146226cc27aa278d2a36104baccec9f70c0ee30b8d6196cfac3540636bfb0875678bb59e4706479919483870
SSDEEP
384:dVgs5ZQcZv/yNUSo7OpteXExya9Eow0yj:dVVzTyNX5pcExTw0yj
Checks for missing Authenticode signature.
resource |
---|
0ac6a4873b8c285e41e047606ec2f8ac_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
ReadFile
CreateFileA
DeleteFileA
lstrcpynA
CreateThread
IsBadReadPtr
GetModuleHandleA
GetModuleFileNameA
VirtualProtect
CopyFileA
GetCurrentProcessId
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetLastError
CreateMutexA
GetTickCount
lstrcmpiA
lstrlenA
Sleep
lstrcmpA
lstrcpyA
ExitProcess
GetSystemDirectoryA
lstrcatA
LoadLibraryA
GetProcAddress
FreeLibrary
OutputDebugStringA
PostThreadMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
MapVirtualKeyA
GetKeyboardState
ToAscii
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
InternetOpenA
InternetQueryDataAvailable
HttpSendRequestA
HttpOpenRequestA
atoi
memmove
??2@YAPAXI@Z
sprintf
strstr
COMResModuleInstance
DeleteSelf
wwhkf
wwhko
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ