GetRecordBuf
InstallMsgHook
LockRecordBuf
ResetRecordBuf
UnLockRecordBuf
UninstallMsgHook
Static task
static1
Behavioral task
behavioral1
Sample
46476c64a301b57dde224cc07432b1e1_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
46476c64a301b57dde224cc07432b1e1_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
46476c64a301b57dde224cc07432b1e1_JaffaCakes118
Size
56KB
MD5
46476c64a301b57dde224cc07432b1e1
SHA1
e32403c092357a6818b932c6745de9b71a83cd14
SHA256
e855dde20af55ca3007827380a5f526fff472c97cebf0c51868bd0daf9b2b10d
SHA512
639d7def2252f41b2316015f149cd13f5e5061de6e06a37a9bdd45f002240771da3ee843a26b81e3b342242e11cd7b3ff6b79a68d6f3ac6526cf5c8f9c54b2be
SSDEEP
768:qKNqfpWrETIrYadztLqZWfK7Sv9K4rYDVya:qKkWETIrYadztL0WfKIKDDVp
Checks for missing Authenticode signature.
resource |
---|
46476c64a301b57dde224cc07432b1e1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleBaseNameW
CloseHandle
WaitForSingleObject
SetEvent
GetCurrentProcess
OpenEventW
CreateEventW
DisableThreadLibraryCalls
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
WideCharToMultiByte
GetCurrentThreadId
GetCommandLineA
GetVersionExA
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
TlsAlloc
SetLastError
GetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetKeyboardState
ToUnicode
CallNextHookEx
UnhookWindowsHookEx
GetWindowLongW
SetWindowsHookExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetRecordBuf
InstallMsgHook
LockRecordBuf
ResetRecordBuf
UnLockRecordBuf
UninstallMsgHook
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ