DllRegisterServer
DllUnregisterServer
Rundll32
ekfs
ekfsEx
Static task
static1
Behavioral task
behavioral1
Sample
09196cd21471de482ce01ed49bbdeffe_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
09196cd21471de482ce01ed49bbdeffe_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
09196cd21471de482ce01ed49bbdeffe_JaffaCakes118
Size
292KB
MD5
09196cd21471de482ce01ed49bbdeffe
SHA1
96a53a8c8e93cd874000220cab95f3f0af24520c
SHA256
95f3f8d2d0bd22ede228c1f48d3e68d5df55f69e13f7bcd60471aeee0ee60351
SHA512
d058130ac2b23a9a688405600f0f08d312f1de411975a03a0e73a2ee98e506685f83d99df4648b446117a8bfd7fd7378023ac7a71d35e3e0065f211f811209c4
SSDEEP
3072:Fk/+JAmO/alIi5nZP+FtQgsHDWIlFFsBdKskZjj+hwnORHuzlIcuAv:Fk/3J/KpZP+wgO35skpvORHmv
Checks for missing Authenticode signature.
resource |
---|
09196cd21471de482ce01ed49bbdeffe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
GetTickCount
DeviceIoControl
WaitForSingleObject
ExitProcess
SetLastError
GetLongPathNameA
OpenProcess
CreateMutexA
GetWindowsDirectoryA
GetShortPathNameA
GetCommandLineA
OutputDebugStringA
CopyFileA
GetCurrentProcess
GetCurrentThread
Process32Next
Module32Next
LockResource
SizeofResource
LoadResource
FindResourceA
LoadLibraryA
GetExitCodeThread
CreateRemoteThread
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
GetPrivateProfileStringA
GetEnvironmentVariableA
GetExitCodeProcess
SearchPathA
WinExec
HeapAlloc
GetProcessHeap
HeapFree
TerminateProcess
GetTempFileNameA
RemoveDirectoryA
SuspendThread
GetThreadContext
FlushInstructionCache
SetThreadContext
ResumeThread
VirtualProtectEx
GetProcAddress
FreeLibrary
OpenMutexA
GetModuleFileNameA
MoveFileExA
CreateProcessA
Sleep
CloseHandle
CreateFileA
GetLastError
FindFirstFileA
FindNextFileA
FindClose
GetSystemDirectoryA
GetTempPathA
DeleteFileA
MoveFileA
VirtualFreeEx
SendMessageA
DestroyWindow
FindWindowA
ShowWindow
FindWindowExA
keybd_event
SetFocus
SetForegroundWindow
GetWindowThreadProcessId
AdjustTokenPrivileges
OpenSCManagerA
CloseServiceHandle
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
ControlService
StartServiceA
OpenServiceA
DeleteService
CreateServiceA
RegQueryValueExA
RegCreateKeyA
LookupPrivilegeValueA
OpenProcessToken
OpenThreadToken
RegSetValueExA
SHGetSpecialFolderPathA
PathIsDirectoryA
SHGetValueA
PathAppendA
PathRemoveFileSpecA
PathCombineA
PathFindFileNameA
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
SetupIterateCabinetA
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
_adjust_fdiv
_initterm
_onexit
__dllonexit
memcpy
_mbslwr
rewind
fgets
fprintf
strncat
strchr
_mbsstr
sscanf
??2@YAPAXI@Z
??3@YAXPAX@Z
strrchr
_strnicmp
_access
fseek
ftell
fread
strstr
__CxxFrameHandler
strcmp
time
srand
memset
strlen
free
strcpy
malloc
sprintf
_mbsnbcpy
_mbscmp
strcat
_snprintf
atoi
_strdup
_stricmp
_strlwr
fclose
fwrite
fopen
_except_handler3
rand
URLDownloadToFileA
DllRegisterServer
DllUnregisterServer
Rundll32
ekfs
ekfsEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ