WLEventLogoff
WLEventLogon
WLEventShutdown
Static task
static1
Behavioral task
behavioral1
Sample
2aa3d912384294a03b6b5291d8208534_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2aa3d912384294a03b6b5291d8208534_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
2aa3d912384294a03b6b5291d8208534_JaffaCakes118
Size
68KB
MD5
2aa3d912384294a03b6b5291d8208534
SHA1
40b1a99492fc76126abaf02915e4558b43a209f6
SHA256
df84b8c404e91504e67a98bf679f57f22c1d9e0311cd211937c866985797d9cd
SHA512
c3e7f5b1f37726c8115fc7d52cd4dd3cd4750255486f7b5b5b3e14655dac62487d0411ec5ea37261222242d0bb07b8e94418a626b5fba994a5ca01dd49a94be0
SSDEEP
1536:DRNOyv5ZV+1k+MD2ibm9HA7S1aeBd1fRlGoOGlcLCF2Eh5:LhO2+MaL9g7WaK5YFtCgo
Checks for missing Authenticode signature.
resource |
---|
2aa3d912384294a03b6b5291d8208534_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedDecrement
CreateSemaphoreA
FindNextFileA
DeleteFileA
FindFirstFileA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
GetComputerNameA
LoadLibraryA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
FindClose
GetEnvironmentVariableA
LocalFree
LocalAlloc
GetLastError
Sleep
DeleteCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GetFileTime
ReadFile
GetFullPathNameA
GetTempFileNameA
GetTempPathA
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
GetLocalTime
GetSystemTime
TerminateProcess
InterlockedIncrement
WinExec
ReleaseSemaphore
ResumeThread
SetThreadContext
VirtualFree
GetThreadContext
VirtualAlloc
VirtualAllocEx
CreateProcessA
FreeLibrary
GetProcAddress
GetVersion
MoveFileExA
MoveFileA
CopyFileA
GetSystemDirectoryA
GetTickCount
GetExitCodeProcess
PeekNamedPipe
GetStartupInfoA
CreatePipe
SetFilePointer
lstrcpyA
lstrcpynA
CreateDirectoryA
RemoveDirectoryA
DisableThreadLibraryCalls
WaitForSingleObject
SetEvent
CreateEventA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
VirtualProtect
GetCurrentProcess
WriteProcessMemory
GetFileAttributesA
GetSystemTimeAsFileTime
OutputDebugStringA
VirtualQuery
HeapFree
GetProcessHeap
HeapAlloc
CreateFileA
WriteFile
lstrlenA
CreateThread
CloseHandle
GetCurrentThreadId
wvsprintfA
MessageBoxA
wsprintfA
OpenProcessToken
RegCreateKeyA
RegNotifyChangeKeyValue
RegEnumValueA
RegDeleteValueA
RegSetValueExA
ImpersonateLoggedOnUser
RevertToSelf
GetTokenInformation
LookupAccountSidA
RegOpenKeyExA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
CreateStreamOnHGlobal
strchr
NtFreeVirtualMemory
NtOpenProcess
_strcmpi
toupper
memmove
NtClose
_strlwr
strstr
RtlUnwind
NtQuerySystemInformation
NtAllocateVirtualMemory
_allmul
__WSAFDIsSet
accept
gethostname
htonl
gethostbyaddr
WSAStartup
recv
getsockname
WSAGetLastError
select
shutdown
setsockopt
closesocket
socket
htons
bind
listen
inet_addr
gethostbyname
connect
send
ioctlsocket
DnsQuery_A
DnsRecordListFree
ord23
ord13
ord135
ord138
ord19
ord11
ord21
ord140
ord129
ord17
ord75
StrChrA
StrToIntA
StrStrA
StrCmpNA
WLEventLogoff
WLEventLogon
WLEventShutdown
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ