DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
f6ce3564a50bc1fd585d67d2f4a6be32_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f6ce3564a50bc1fd585d67d2f4a6be32_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f6ce3564a50bc1fd585d67d2f4a6be32_JaffaCakes118
Size
203KB
MD5
f6ce3564a50bc1fd585d67d2f4a6be32
SHA1
dd099c65a89a335b44eccc58a2a3e6fd0693b04e
SHA256
5a902d9af473eba521c90e79ea6eb169a3a0fe67e81da5d644b1bccdf2a06cb6
SHA512
65d3a87bad46ced5907487bed74533c60fda0e2c3c86d6fa7e6a9dd58371d3c76c4f99f8a6786c7c156add224d6e94dca9a9fc673770a0cab091d83b302ffc4e
SSDEEP
3072:KnDZx0yBK8w45xgj7YzJXEYGIo60CxRc0Gf:KDZx0yDwCx+YFXbODf
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f6ce3564a50bc1fd585d67d2f4a6be32_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapAlloc
CopyFileA
VirtualAlloc
DeleteFileA
MoveFileA
FindResourceA
SizeofResource
LoadResource
FreeLibrary
HeapFree
IsBadReadPtr
LoadLibraryA
GetProcAddress
VirtualFree
VirtualProtect
Sleep
GetUserDefaultLangID
GetProcessHeap
_adjust_fdiv
malloc
_initterm
calloc
free
strlen
realloc
__CxxFrameHandler
memset
_mbscmp
strcmp
rand
memcpy
_strlwr
_stricmp
MessageBoxA
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE