getActiveDesktop
getWnd
Static task
static1
Behavioral task
behavioral1
Sample
2dd4c21c24d12a76e0a13da3595a90b9_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2dd4c21c24d12a76e0a13da3595a90b9_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
2dd4c21c24d12a76e0a13da3595a90b9_JaffaCakes118
Size
16KB
MD5
2dd4c21c24d12a76e0a13da3595a90b9
SHA1
abab1799e1834da6bf938fcf1fcd2dab444ba112
SHA256
80d25012ccba61736d01afb1957168af5c4a35b8fe1a5ad6daf34e03286765d8
SHA512
6d7244da9a50c905bb6303220ece8a59ff73fcdfac0a7e683e8b0fc4cbab1c71586475128d3f448ba65a9fbf301a6279cfb912878348de4d4c4bc95dd429afaf
SSDEEP
384:GYDmMW3sLczE8RLzx7XrzBTRDWr8GxbkJ1KQKiK1KnWCVWua:GqW3xHLt7XBUr8GxYc7Zc1za
Checks for missing Authenticode signature.
resource |
---|
2dd4c21c24d12a76e0a13da3595a90b9_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
DisableThreadLibraryCalls
lstrcmpiW
CreateThread
WideCharToMultiByte
VirtualFreeEx
MultiByteToWideChar
lstrcmpiA
GetProcAddress
VirtualAllocEx
GetModuleHandleA
GetCurrentProcessId
lstrcmpA
VirtualFree
VirtualAlloc
GetModuleHandleW
GetModuleFileNameA
VirtualProtect
IsBadReadPtr
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExW
RtlFreeAnsiString
NtQueryInformationThread
NtClose
RtlUnicodeStringToAnsiString
NtOpenProcess
strstr
memset
memcpy
getActiveDesktop
getWnd
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ