COMResModuleInstance
DriverProc
KsCreateAllocator
KsCreatePin
KsCreateTopologyNode
ServerMain
modMessage
modmCallback
Static task
static1
Behavioral task
behavioral1
Sample
5293f975164514b9fa75cb968f3b6222_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5293f975164514b9fa75cb968f3b6222_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
5293f975164514b9fa75cb968f3b6222_JaffaCakes118
Size
33KB
MD5
5293f975164514b9fa75cb968f3b6222
SHA1
6239903eefb0067b18b410785e7a0d91ee582941
SHA256
8df9d760c8c39384457ca9a44dc10afe8608fa28e7ef0d7a5c22a60d032f2a1b
SHA512
eb8c39a4aa49a74a8175a90ea81e9f6609de8dbb43c2140f4d7cd3bf77b4b14bb764724d0c26dc3ade38161ebc5ec0cef870e4789bf6c1f070be19f7900a5da6
SSDEEP
768:1sFKIWQKMkI6QMuVH9I7OYVe+hGZLqGGU0LwRTot:iFKIBKLrduVu7OYVLUYGG3
Checks for missing Authenticode signature.
resource |
---|
5293f975164514b9fa75cb968f3b6222_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ReadFile
GetFileSize
FreeLibrary
SetFilePointer
GetLastError
CreateEventA
GetModuleFileNameA
GetTempPathA
GetWindowsDirectoryA
Process32Next
CreateThread
CreateToolhelp32Snapshot
MoveFileExA
GetTempFileNameA
GetFileAttributesA
TerminateProcess
OpenProcess
CopyFileA
GetCommandLineA
GetSystemDirectoryA
MultiByteToWideChar
DeleteFileA
GlobalLock
CreateFileA
WriteFile
GlobalUnlock
GlobalFree
CloseHandle
LoadLibraryA
GetProcAddress
GlobalAlloc
VirtualProtect
GetModuleHandleA
Sleep
ExitProcess
Process32First
IsBadReadPtr
SetWindowLongA
RegisterShellHookWindow
RegisterWindowMessageA
EnumWindows
GetClassNameA
CallWindowProcA
wsprintfA
GetDesktopWindow
GetDC
GetWindowRect
FindWindowA
GetParent
GetWindowThreadProcessId
ReleaseDC
GetWindowTextA
GetClientRect
CreateDCA
GetDeviceCaps
DeleteDC
DeleteObject
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
RealizePalette
SelectPalette
GetStockObject
GetObjectA
GdiplusShutdown
GdipDisposeImage
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipFree
GdipAlloc
GdipCloneImage
GdipSaveImageToFile
GdipLoadImageFromFile
??0_Lockit@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
connect
htons
gethostbyname
socket
recv
send
inet_ntoa
WSAStartup
WSACleanup
inet_addr
closesocket
GetModuleFileNameExA
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetCloseHandle
strrchr
_access
strchr
strncpy
strstr
abs
malloc
wcscmp
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strupr
_strlwr
_getpid
_stricmp
_strrev
free
??2@YAPAXI@Z
__CxxFrameHandler
memcpy
strncmp
strcat
atoi
sprintf
strlen
strcmp
strcpy
memset
Netbios
COMResModuleInstance
DriverProc
KsCreateAllocator
KsCreatePin
KsCreateTopologyNode
ServerMain
modMessage
modmCallback
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ