ServiceRouteExA
StartServiceEx
StopServiceEx
Static task
static1
Behavioral task
behavioral1
Sample
17e7ab0c82dbd7befb21575ad96559ea_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
17e7ab0c82dbd7befb21575ad96559ea_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
17e7ab0c82dbd7befb21575ad96559ea_JaffaCakes118
Size
19KB
MD5
17e7ab0c82dbd7befb21575ad96559ea
SHA1
eb8b34ef0b0153f12cf42cf31d54dd3429dfa4ab
SHA256
dda48d9266d5bcdcc3e05d2f14d87615e065007c0cf23f293ede87a557ea7653
SHA512
bb1f482f28e09bfd2ecc851773861fe5185ca41f50ffb7e63f6734f4480e24143a6c5c98e8e5b291f652cac45965b06911f8b077f1ec2e85735b590f5ffbfe2a
SSDEEP
384:RALk1sxlAqFRvmO0OwuBBQARQkhtJaHN/K:RJO6+RvmO0OnBBQARQk4HN/K
Checks for missing Authenticode signature.
resource |
---|
17e7ab0c82dbd7befb21575ad96559ea_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
strstr
strlen
memcpy
memcmp
RtlZeroMemory
RtlUnwind
closesocket
gethostname
InternetReadFile
InternetOpenA
InternetCloseHandle
VirtualFree
IsBadReadPtr
GetTempPathA
GetTempFileNameA
GetStartupInfoA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcmpA
lstrcpynA
lstrcpyA
lstrcmpiA
WriteFile
WaitForSingleObject
TerminateThread
Sleep
SizeofResource
LockResource
CloseHandle
CreateFileA
GetExitCodeThread
GetFileSize
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
LoadLibraryA
ReadFile
VirtualAlloc
FindResourceA
VirtualProtectEx
lstrcatA
lstrlenA
CreateProcessA
CreateThread
DeleteFileA
LoadResource
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
wsprintfA
ServiceRouteExA
StartServiceEx
StopServiceEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ