Rool
ServiceMain
whm
Behavioral task
behavioral1
Sample
0b196c46f9766a1e346c6df95bb66417_JaffaCakes118.dll
Resource
win7-20240903-en
Target
0b196c46f9766a1e346c6df95bb66417_JaffaCakes118
Size
97KB
MD5
0b196c46f9766a1e346c6df95bb66417
SHA1
80fc25a615a57f949db396fa91b102bee34c27c5
SHA256
1de0266ccb76ec90ee0d32e4cfc2cd01fe8241635daa28c27f31294cb3ad16fc
SHA512
c5dfba710ac43144435d9a7a957d72288c1ab7e49a94246cc4fbf50834284867592afb835c21d06364fdf0c8ba1f7b6d3cc21023c42f43b15d1c2f6dc61ebe3f
SSDEEP
1536:5ATuIg55YQFoXJHvhDlA5LaYRpvq2gNCSklcQOEfkgaS7lUTwErhLV:STuIg5CQ0HvhDFNzklfO2kgay2TwEr
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
0b196c46f9766a1e346c6df95bb66417_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
GetTickCount
ReleaseMutex
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
DisconnectNamedPipe
CreatePipe
GetStartupInfoA
WaitForMultipleObjects
PeekNamedPipe
lstrlenA
TerminateProcess
MoveFileExA
OpenProcess
FreeLibrary
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
GetModuleFileNameA
MoveFileA
GlobalSize
SetFilePointer
ReadFile
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
FindClose
GetLogicalDriveStringsA
GetDiskFreeSpaceExA
GetDriveTypeA
CreateProcessA
CreateDirectoryA
GetLastError
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
MultiByteToWideChar
GetWindowsDirectoryA
GetPrivateProfileSectionNamesA
Sleep
LoadLibraryA
GetProcAddress
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
CreateEventA
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
TerminateThread
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
CreateFileMappingA
MapViewOfFile
GetProcessHeap
WriteFile
HeapFree
CloseHandle
Process32Next
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MapVirtualKeyA
GetSystemMetrics
keybd_event
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
ExitWindowsEx
GetWindowThreadProcessId
IsWindow
SendMessageA
SystemParametersInfoA
BlockInput
DestroyCursor
DispatchMessageA
SetRect
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
GetClipboardData
LoadCursorA
TranslateMessage
GetMessageA
CharNextA
GetWindowTextA
GetActiveWindow
GetKeyNameTextA
CloseWindow
CreateWindowExA
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
EnumWindows
IsWindowVisible
DeleteObject
BitBlt
CreateDIBSection
SelectObject
CreateCompatibleBitmap
GetDIBits
CreateCompatibleDC
DeleteDC
RegQueryValueA
IsValidSid
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
LsaFreeMemory
RegCloseKey
RegOpenKeyExA
CloseServiceHandle
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
LookupAccountSidA
GetTokenInformation
LookupAccountNameA
SHGetFileInfoA
SHGetSpecialFolderPathA
SHDeleteKeyA
_strnicmp
_strcmpi
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
calloc
_beginthreadex
wcstombs
atoi
realloc
strncat
strncpy
sprintf
strrchr
_except_handler3
free
malloc
strchr
_CxxThrowException
strstr
_ftol
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
waveOutClose
waveOutReset
waveInClose
waveInUnprepareHeader
waveInReset
waveInStop
waveOutWrite
waveInStart
waveInAddBuffer
waveInPrepareHeader
waveOutGetNumDevs
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutOpen
gethostname
send
select
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
ntohs
recv
getsockname
closesocket
WSAStartup
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringA
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
capGetDriverDescriptionA
capCreateCaptureWindowA
ICSeqCompressFrame
ICSendMessage
ICOpen
ICClose
ICCompressorFree
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
EnumProcessModules
GetModuleFileNameExA
WTSFreeMemory
WTSQuerySessionInformationA
Rool
ServiceMain
whm
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ