BhoInstall
_WorkProc@4
__mp@4
Static task
static1
Behavioral task
behavioral1
Sample
529b379fc516ac4bc32962532dc432f1_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
529b379fc516ac4bc32962532dc432f1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Target
529b379fc516ac4bc32962532dc432f1_JaffaCakes118
Size
50KB
MD5
529b379fc516ac4bc32962532dc432f1
SHA1
078cf093632e1a98360a9013bbe427f29893bd68
SHA256
d98c4c20d051c259591326aff27d115d3b9d762e67028c74c96f025929db3972
SHA512
4f7ac60ec62ac9cffda06358ab24db30641d76e689a9881a4091532740bbdb974dec3ccc6f843266c19ea089b9c03e0f570e0c683da3e26a3b0bd47c0052857c
SSDEEP
1536:OCYQsnkiM3oX4OvQQczJYMgdc6YL0VWZMhES1iZd:OCNsnkiM3oXH8zJYMgc6YLKSSES1
Checks for missing Authenticode signature.
resource |
---|
529b379fc516ac4bc32962532dc432f1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
SystemTimeToFileTime
GetLocalTime
CloseHandle
Sleep
HeapFree
ReleaseMutex
WaitForSingleObject
CreateMutexA
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
TerminateThread
CreateFileMappingA
lstrcpynA
HeapReAlloc
DeleteFileA
CreateProcessA
PulseEvent
GetFileAttributesA
GetCurrentProcess
VirtualFree
WinExec
FreeLibrary
GetModuleHandleA
GetProcAddress
GetModuleFileNameA
VirtualProtect
VirtualQuery
lstrcmpiA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
OpenMutexA
OpenProcess
LoadLibraryA
FlushInstructionCache
SetLastError
lstrcmpA
FileTimeToSystemTime
GetCurrentThreadId
GetVersionExA
OutputDebugStringA
GetTickCount
MapViewOfFileEx
VirtualAlloc
SetThreadContext
WriteProcessMemory
VirtualProtectEx
GetThreadContext
ResumeThread
DuplicateHandle
CreateRemoteThread
FindNextFileA
FindFirstFileA
TerminateProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
VirtualAllocEx
VirtualFreeEx
QueryDosDeviceA
GetLogicalDriveStringsA
CreateThread
GetTempFileNameA
GetTempPathA
CopyFileA
GetSystemDirectoryA
GetFileSize
CreateFileA
lstrcatA
RemoveDirectoryA
GetWindowsDirectoryA
OpenFile
CompareFileTime
GetCurrentProcessId
CreateEventA
GetLastError
WaitForSingleObjectEx
ResetEvent
OpenEventA
SetEvent
ExitProcess
GetProcessHeap
HeapAlloc
lstrcpyA
IsBadReadPtr
lstrlenA
MessageBoxA
wsprintfA
AdjustTokenPrivileges
RegSetValueExA
RegOpenKeyExA
RegEnumValueA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetTokenInformation
OpenProcessToken
RegDeleteValueA
SHGetSpecialFolderPathA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetQueryDataAvailable
InternetReadFile
InternetCanonicalizeUrlA
SHDeleteKeyA
RpcStringFreeA
UuidToStringA
UuidCreate
BhoInstall
_WorkProc@4
__mp@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE