AR
DelFuc
GetVer
w
Static task
static1
Behavioral task
behavioral1
Sample
0b8d5b16f28239543ed73c6bf8ff4d15_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b8d5b16f28239543ed73c6bf8ff4d15_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
0b8d5b16f28239543ed73c6bf8ff4d15_JaffaCakes118
Size
64KB
MD5
0b8d5b16f28239543ed73c6bf8ff4d15
SHA1
2117419665a8226254230fd80822d33f40623b02
SHA256
b9a37620420faad8067e7e37c47f0bb48ef8e363051e08b041131d2af53306a4
SHA512
fef56929fd347c2304edad8b094ded22e3631072fa6dc2abdd8610ed59a9d0e908223a1b2d8db5ad69ae2298e866e8849fb0585b3e8fe9bd4f4da24a1399486d
SSDEEP
768:/0zPetgc3Jarb8ZL79Vy62kcXwUTZFBI17nMhVdlIh3r:/0zPeDUn8ZnAoUTZFA7QVm3r
Checks for missing Authenticode signature.
resource |
---|
0b8d5b16f28239543ed73c6bf8ff4d15_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
DeleteFileA
WinExec
GetBinaryTypeA
GetTickCount
GetTempPathA
WriteProcessMemory
VirtualProtectEx
GetCurrentProcess
LoadLibraryA
ExitProcess
TerminateProcess
CreateThread
lstrlenW
WideCharToMultiByte
CloseHandle
GetModuleFileNameA
GetFileAttributesA
GetLocalTime
GetComputerNameA
GetModuleHandleA
GetProcAddress
GetVersionExA
GetCurrentProcessId
GetSystemInfo
GetWindowThreadProcessId
DispatchMessageA
TranslateMessage
GetMessageA
SetTimer
SetWindowsHookExA
CharLowerA
wsprintfA
GetSystemMetrics
CallNextHookEx
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
CoInitialize
CoCreateInstance
SysFreeString
VariantClear
Netbios
send
gethostbyname
ntohs
getpeername
connect
htons
inet_addr
socket
WSAStartup
closesocket
recvfrom
sendto
setsockopt
inet_ntoa
recv
free
_splitpath
__CxxFrameHandler
??3@YAXPAX@Z
malloc
_adjust_fdiv
calloc
_initterm
_except_handler3
printf
fgets
fopen
fclose
_stricmp
memcmp
strstr
strcat
_access
rename
strncmp
strchr
memcpy
??2@YAPAXI@Z
atoi
strcpy
strlen
sprintf
memset
AR
DelFuc
GetVer
w
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ