ServiceMain
aaaaaaaaaaaa
bbbbbbbbbbbb
cccccccccccc
zzzzzzzzzzzzz
Behavioral task
behavioral1
Sample
JaffaCakes118_464c9927df3109f00edfe8a0c7bd46dd.dll
Resource
win7-20240903-en
Target
JaffaCakes118_464c9927df3109f00edfe8a0c7bd46dd
Size
62KB
MD5
464c9927df3109f00edfe8a0c7bd46dd
SHA1
8b96f9660ddfd4fff090e150ffaf045242201322
SHA256
0c36b4dcbf6db81fc7331666a7d0ad020da959ad4f11b1f8b878bd3c5ac22225
SHA512
09f93e5bda056e163f8c9f605656364e64c93b8f782aca8a6b2ce80cd132c9d62d22291be79e13b7da5a2ffe322f8e5fd32a7fcb65ee30470dc6e80fe0478350
SSDEEP
768:YDA418dOcU5UoTr737QR8RPCh7xPeVZ4jFOZGcWVthr5t5bfPACsBc7AfsJkKf3z:YcooRYCh8Vaj7cm5ffPACsSwgJf3z
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
JaffaCakes118_464c9927df3109f00edfe8a0c7bd46dd |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MoveFileA
GetLocalTime
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
WriteFile
LocalAlloc
PeekNamedPipe
WaitForMultipleObjects
MoveFileExA
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
FreeConsole
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
RaiseException
CreateEventA
GetWindowsDirectoryA
TerminateThread
GetTickCount
SleepEx
ExitThread
OpenProcess
FreeLibrary
lstrcatA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
lstrcpyA
CreateProcessA
LocalFree
SetLastError
GetLastError
GetModuleFileNameA
CreateFileA
InitializeCriticalSection
SetFilePointer
ReadFile
lstrlenA
DeleteFileA
Sleep
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
LoadLibraryA
GetProcAddress
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
SetProcessWindowStation
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegisterServiceCtrlHandlerA
SetServiceStatus
SHDeleteKeyA
??1type_info@@UAE@XZ
_strnicmp
_adjust_fdiv
_initterm
_strcmpi
free
calloc
_beginthreadex
wcstombs
atoi
realloc
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
_except_handler3
strncpy
strrchr
malloc
strtok
strncat
strchr
select
WSAIoctl
closesocket
send
inet_addr
socket
sendto
WSASocketA
inet_ntoa
getsockname
gethostbyname
htons
connect
gethostname
setsockopt
WSAStartup
WSACleanup
recv
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA
ServiceMain
aaaaaaaaaaaa
bbbbbbbbbbbb
cccccccccccc
zzzzzzzzzzzzz
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ