DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
Behavioral task
behavioral1
Sample
07d106b75f307131bdc249b44f07ca21_JaffaCakes118.dll
Resource
win7-20240508-en
Target
07d106b75f307131bdc249b44f07ca21_JaffaCakes118
Size
148KB
MD5
07d106b75f307131bdc249b44f07ca21
SHA1
3101658b77bdd244f38207b44d030436d21ce987
SHA256
a614a9ba1ccc18e402acac2cd19853c3409caff63c326c87d287b99158fc3f93
SHA512
e473b37e472d31a7739bc604766bddd6cb096730757f9c0ddc089c4c827f70d2e535e8b12c6eda20324e5fa46b10c5391cf2b87d8d2b62b04d203fec7a0e0de0
SSDEEP
3072:Z3BDgPAN3LERTu9YqZxoYOHCiGFLLHTBftbntYesD:Z3NARTu9fOi1LLHTBlbntxsD
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
07d106b75f307131bdc249b44f07ca21_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SHFileOperationA
CoInitialize
CoUninitialize
CoTaskMemFree
CoCreateInstance
SHDeleteKeyA
SysFreeString
DestroyWindow
wsprintfA
CloseWindowStation
CreateWindowExA
LoadCursorA
DestroyCursor
GetCursorInfo
GetClassNameA
GetWindow
ShowWindow
EnableWindow
GetWindowRect
wvsprintfA
MessageBoxA
RegOpenKeyExW
RegisterServiceCtrlHandlerExA
QueryServiceStatusEx
FormatMessageA
SetUnhandledExceptionFilter
GetLongPathNameA
GetTempPathA
SetEnvironmentVariableA
GetFileAttributesExA
GetCurrentProcessId
VirtualQuery
WinExec
IsBadWritePtr
MapViewOfFile
GetLocalTime
GetTempFileNameA
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
FreeLibrary
MultiByteToWideChar
GlobalSize
LoadLibraryA
GlobalLock
GlobalUnlock
RaiseException
CreateFileMappingA
GlobalAlloc
lstrlenA
lstrcpyA
CloseHandle
lstrcmpiA
WideCharToMultiByte
GetTickCount
ExitProcess
lstrcatA
GetSystemDirectoryA
GetSystemInfo
GetVersionExA
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GetCommandLineA
HeapFree
GetProcessHeap
VirtualFree
Sleep
HeapAlloc
DeleteFileA
RemoveDirectoryA
ExitThread
GetShortPathNameA
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
GetModuleHandleA
lstrcmpA
GetProcAddress
ExpandEnvironmentStringsA
GetLastError
LocalFree
LocalReAlloc
LocalAlloc
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
LocalSize
InterlockedExchange
GetCurrentThreadId
GlobalFree
GetAdaptersInfo
shutdown
closesocket
select
recv
gethostbyname
socket
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
getsockname
gethostname
send
_memicmp
wcstombs
_except_handler3
_ftol
srand
rand
strchr
atoi
strncpy
strstr
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
malloc
strrchr
memmove
ceil
_beginthreadex
atol
_adjust_fdiv
_initterm
_onexit
__dllonexit
_stricmp
free
_strupr
_wcsicmp
_strlwr
realloc
strncat
wcsrchr
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ