DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1b43bd9dfeeb4054714e89ccab9b7212_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1b43bd9dfeeb4054714e89ccab9b7212_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1b43bd9dfeeb4054714e89ccab9b7212_JaffaCakes118
Size
40KB
MD5
1b43bd9dfeeb4054714e89ccab9b7212
SHA1
88b014a3d701db87fb609c67801148869458f914
SHA256
1eb00e174254252541e15740a987d73fed3d4358e2b9c258ba4163fcaf4b7274
SHA512
75dd661b7565b271a743bc2099770e0fd5fa99418e05fd830868cdb33b168e3d4331fcb054477d701799b4b422ae92b31b4bc85c9d51f3c9a626f2d569869756
SSDEEP
384:KctKrN52ZRKRdI+rJYtPtTmSYRsoPzb5xJwNTPJ7rGI07MoXFQzlAew6:NtKraZc7I+rJEroP3cTPpqMSgl9w6
Checks for missing Authenticode signature.
resource |
---|
1b43bd9dfeeb4054714e89ccab9b7212_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
socket
htons
ioctlsocket
gethostbyname
closesocket
recv
connect
LocalFree
CreateThread
IsBadStringPtrA
LoadLibraryA
Sleep
GetProcAddress
GetLastError
GetSystemInfo
IsBadReadPtr
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
InterlockedDecrement
CloseHandle
GetModuleHandleA
CreateFileA
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
ExitProcess
GetModuleFileNameA
CallNextHookEx
InternetCrackUrlA
CoInitializeEx
CoCreateInstance
OleRun
SysFreeString
SysAllocString
VariantClear
GetErrorInfo
??1type_info@@UAE@XZ
_CxxThrowException
_adjust_fdiv
_initterm
_onexit
__dllonexit
fgets
fseek
malloc
wcslen
??2@YAPAXI@Z
__CxxFrameHandler
sprintf
??3@YAXPAX@Z
atoi
free
_strdup
realloc
calloc
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ