DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f55f396c4813b0e902b477d0a076193c_JaffaCakes118.dll
Resource
win7-20240220-en
Target
f55f396c4813b0e902b477d0a076193c_JaffaCakes118
Size
466KB
MD5
f55f396c4813b0e902b477d0a076193c
SHA1
e733f997c01d638dff7985afc6bebce6b8bbfb04
SHA256
2fff5fcd16bd63299ce96deea2e4787e2a2e89628075d76444be0df155be088e
SHA512
d2d597f0611d37d7c07f06adfede4afc2c800ddd68f6bd56162178da0e5aadc343f07808253583a9ba8f6b2988a3e270377cbd2ed1f4fa4c48659f2f3b2983cd
SSDEEP
6144:lCIMU1CQv6zrx6h41Y8Gw+Gp5PRRFhl0NpPsSrRdgdJ0c82AXeL5WrmHe7/KBTA0:lzL1erx6h4pzH5JR7+POH0c8LSBBTA
Checks for missing Authenticode signature.
resource |
---|
f55f396c4813b0e902b477d0a076193c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateThread
LoadLibraryW
GetProcAddress
lstrlenW
WideCharToMultiByte
GetLastError
lstrcmpiW
MultiByteToWideChar
GetModuleHandleW
RaiseException
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetThreadLocale
FindResourceW
GetWindowsDirectoryW
CreateFileW
WriteFile
CloseHandle
WinExec
OpenProcess
lstrlenA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetTimeZoneInformation
GetLocaleInfoW
IsValidCodePage
LockResource
LoadResource
SizeofResource
FreeLibrary
LoadLibraryExW
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetThreadLocale
InitializeCriticalSection
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
VirtualAlloc
GetFileType
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
HeapSize
Sleep
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetProcessHeap
GetVersionExA
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
LCMapStringA
RtlUnwind
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
HeapFree
HeapReAlloc
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CharLowerW
PostMessageW
CharLowerA
CharNextW
UnregisterClassA
MessageBoxW
IsTextUnicode
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
SHGetFolderPathW
CoTaskMemAlloc
CoGetClassObject
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
UnRegisterTypeLi
SysAllocStringLen
SysFreeString
VarUI4FromStr
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
LoadRegTypeLi
LoadTypeLi
VarBstrCat
VariantClear
RegisterTypeLi
SysStringLen
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllUnregisterProxy
InternetCrackUrlW
InternetGetCookieW
InternetSetCookieW
InternetCloseHandle
InternetOpenW
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
CoInternetGetSession
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ