AR
GetVer
w
Static task
static1
Behavioral task
behavioral1
Sample
3aae4a94b58aff5e9ea4b7f2c376868f_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
3aae4a94b58aff5e9ea4b7f2c376868f_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
3aae4a94b58aff5e9ea4b7f2c376868f_JaffaCakes118
Size
36KB
MD5
3aae4a94b58aff5e9ea4b7f2c376868f
SHA1
ba101b9d394a123a0d6c3ea39f6074d222ff1b71
SHA256
06dfd90e3dd9a29b04eeabaa738a72922c0c99e2c151cd8889c31f28d6b3b2c8
SHA512
612288e2d36fa710ef88d5b4f9af668cd7967169fc78cc1577cbdc0d2a87f2337863ca0380bd2a7d7be00af73e7f2293bf053f48edeb8e29e809c5bb26b384f0
SSDEEP
384:tIALn+P03KgN4QR1Mzr12/DcMzDRpXoAlm:2ALn+oKgbjMzZ4cMz3v
Checks for missing Authenticode signature.
resource |
---|
3aae4a94b58aff5e9ea4b7f2c376868f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateThread
GetCurrentProcessId
FreeLibrary
GetTempPathA
GetCurrentProcess
Sleep
LoadLibraryA
GetProcAddress
GetTickCount
GetModuleFileNameA
GetSystemInfo
CopyFileA
lstrcmpiA
GetVersionExA
CloseHandle
GetWindowTextA
GetMessageA
DispatchMessageA
GetSystemMetrics
GetWindowThreadProcessId
EnumWindows
GetClassNameA
TranslateMessage
GetWindowTextLengthA
wsprintfA
CharLowerA
CallNextHookEx
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCreateKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
strncpy
_adjust_fdiv
_initterm
_splitpath
fgets
strstr
malloc
free
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
_access
fopen
fseek
sprintf
fputc
fwrite
_stricmp
fclose
fread
AR
GetVer
w
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ