CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg
Static task
static1
Behavioral task
behavioral1
Sample
19c55f18a22ee780e2df48145f886ebe_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
19c55f18a22ee780e2df48145f886ebe_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
/tbu07811/down.html
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
/tbu07811/down.html
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
/tbu07811/imagehotel.dll
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
/tbu07811/imagehotel.dll
Resource
win10v2004-20240508-en
Target
19c55f18a22ee780e2df48145f886ebe_JaffaCakes118
Size
241KB
MD5
19c55f18a22ee780e2df48145f886ebe
SHA1
d03f5e06a615425b18629538b6cbfadce5f30e18
SHA256
01af667bbbf0effbc5f617d69a8f9605ca60bdd42adfcfe74ad188cb0c452a3d
SHA512
bfe2b9399c2eeaa8dd259f67e86319d1600393a4c058229dc7e40794e7073158ca5e2fd19b9b39b652abaf22305bf5ae9604189713576d704d50af8e51993db0
SSDEEP
6144:WGeaNH22gKwRxDxc55n1+YZMlFK4PNI+BxAHxE:WGe622gzxVcn1jMl0gI+fAW
Checks for missing Authenticode signature.
resource |
---|
19c55f18a22ee780e2df48145f886ebe_JaffaCakes118 |
unpack001//tbu07811/imagehotel.dll |
resource | yara_rule |
---|---|
sample | nsis_installer_1 |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ImageList_Create
ord17
ImageList_AddMasked
ImageList_Destroy
GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
CopyFileA
SetErrorMode
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GetVersion
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
EnterCriticalSection
Sleep
LeaveCriticalSection
InitializeCriticalSection
CloseHandle
GlobalFree
GetModuleHandleA
LoadLibraryA
CreateThread
GetProcAddress
FreeLibrary
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
MulDiv
ExitProcess
CreateDialogParamA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
SetFocus
ScreenToClient
GetWindowRect
GetWindowLongA
SetClassLongA
IsWindowEnabled
SetWindowPos
LoadCursorA
SetCursor
GetDlgItemTextA
MapWindowPoints
GetMessagePos
LoadBitmapA
CallWindowProcA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
MessageBoxA
CharPrevA
DestroyWindow
SetTimer
SetForegroundWindow
ShowWindow
CharNextA
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
GetSysColor
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
PostQuitMessage
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
GetWindowTextA
DrawTextA
EndPaint
InvalidateRect
SetBkColor
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateSolidBrush
CreateFontA
SetBkMode
SetTextColor
CreateBrushIndirect
SelectObject
RegEnumValueA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyA
RegCloseKey
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
OleInitialize
OleUninitialize
CoCreateInstance
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PlaySoundA
PathFileExistsA
InternetConnectA
FindFirstUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
DeleteUrlCacheEntry
InternetCrackUrlA
InternetOpenA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
HttpQueryInfoA
InternetReadFile
SetupIterateCabinetA
RemoveDirectoryA
GetVersionExA
DeleteFileA
CloseHandle
WriteFile
CreateFileA
GetTempPathA
MoveFileExA
Sleep
InterlockedIncrement
InterlockedDecrement
GetModuleFileNameA
GetLastError
SetEvent
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
FreeLibrary
FindClose
FindNextFileA
GetProcAddress
FindFirstFileA
lstrcpyA
lstrcatA
SetLastError
LoadLibraryA
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
TerminateThread
GetCurrentThreadId
GetVersion
DebugBreak
GlobalUnlock
GlobalLock
GetVolumeInformationA
GetDriveTypeA
GetLogicalDriveStringsA
CopyFileA
MoveFileA
GetTempFileNameA
WaitForSingleObject
ResetEvent
CreateEventA
LeaveCriticalSection
EnterCriticalSection
GlobalAlloc
FlushInstructionCache
GetCurrentProcess
GetCurrentProcessId
lstrcmpA
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThread
HeapFree
HeapAlloc
GetProcessHeap
SetCurrentDirectoryA
DisableThreadLibraryCalls
GetShortPathNameA
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
HeapDestroy
InterlockedExchange
LocalAlloc
RaiseException
LocalFree
GetWindowTextA
GetWindowTextLengthA
RegisterClassExA
CloseClipboard
CreateAcceleratorTableA
DefWindowProcA
GetClipboardData
SetWindowRgn
ReleaseDC
GetDC
OffsetRect
GetMenuItemInfoA
CopyRect
GetWindow
ShowWindow
IsWindowVisible
GetAsyncKeyState
GetWindowRect
CharUpperA
LoadMenuA
InsertMenuA
DestroyMenu
LoadImageA
MapWindowPoints
LoadStringA
GetMessagePos
GetCursorPos
GetFocus
wvsprintfA
GetWindowLongA
SetWindowLongA
SetWindowPos
WindowFromPoint
SetCursor
ScreenToClient
PtInRect
GetClassInfoExA
GetClassNameA
InvalidateRect
KillTimer
SetWindowsHookExA
TrackPopupMenu
SetTimer
CharNextA
MessageBoxA
UnhookWindowsHookEx
GetSystemMetrics
SetWindowTextA
GetClientRect
CharLowerA
GetSubMenu
CallNextHookEx
GetSysColor
FillRect
SendMessageA
wsprintfA
IsWindow
GetParent
OpenClipboard
DrawEdge
GetKeyState
DestroyWindow
CreatePopupMenu
AppendMenuA
CheckMenuItem
EnableMenuItem
CallWindowProcA
SetFocus
IsChild
EndPaint
BeginPaint
RedrawWindow
GetDesktopWindow
DestroyAcceleratorTable
ReleaseCapture
DestroyCursor
PostMessageA
EmptyClipboard
EndMenu
UnregisterClassA
TranslateMessage
DispatchMessageA
SetActiveWindow
MoveWindow
GetActiveWindow
CreateWindowExA
GetDlgItem
RegisterWindowMessageA
SetCapture
LoadCursorA
InvalidateRgn
LoadCursorFromFileA
SelectObject
CreateBrushIndirect
GetDeviceCaps
GetTextExtentPoint32A
DeleteObject
GetTextMetricsA
SetBkColor
SetBkMode
SetTextColor
CreateFontA
CreateRectRgn
GetObjectA
CreateSolidBrush
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
GetStockObject
GetTextExtentPointA
ExtTextOutA
SHAddToRecentDocs
DragQueryFileA
ShellExecuteA
OleUninitialize
OleRun
CoTaskMemRealloc
OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleInitialize
CreateStreamOnHGlobal
RegisterDragDrop
CoUninitialize
ReleaseStgMedium
CoInitialize
CoCreateInstance
CoCreateGuid
RegisterTypeLi
GetErrorInfo
VarUI4FromStr
SafeArrayCreateVector
LoadRegTypeLi
OleCreateFontIndirect
SafeArrayAccessData
SafeArrayUnaccessData
DispCallFunc
VariantInit
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantClear
SafeArrayPutElement
SafeArrayCreate
SysStringByteLen
VariantChangeType
LoadTypeLi
VariantCopy
SafeArrayDestroy
UuidFromStringA
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@IDABV?$allocator@D@1@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEPADXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
rand
strcmp
_mkdir
_chdir
wcscpy
wcscmp
strtod
wcsstr
realloc
wcstol
wcstod
_strlwr
fread
ftell
srand
wcsncpy
isdigit
_fullpath
wcslen
_itoa
_except_handler3
atoi
time
localtime
mktime
fseek
difftime
_beginthread
free
memcpy
_CxxThrowException
strstr
wcschr
_adjust_fdiv
fopen
fgets
fclose
strcat
strcpy
strrchr
??2@YAPAXI@Z
strlen
memcmp
memmove
__CxxFrameHandler
memset
malloc
__dllonexit
strtok
_purecall
fwrite
_wcsicmp
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
sprintf
CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TBStudioReg
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ