DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
24adcb317d03c1f3286fd1b2a5520e3c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
24adcb317d03c1f3286fd1b2a5520e3c_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
24adcb317d03c1f3286fd1b2a5520e3c_JaffaCakes118
Size
143KB
MD5
24adcb317d03c1f3286fd1b2a5520e3c
SHA1
a11ea309a5638d07e0b067157033d9a94d801b81
SHA256
0f74d449a4abc40d820afeb2e5674fd6dd328fc3b35666873177aed319cf6db1
SHA512
d68d3a3682a240405a2334165bfa785597887a9d2e93796786a6f0ba0a4ce979dcae8110c308b8d47d77d77ef05b1f64e48394654a0b72212c3031c7762d1b12
SSDEEP
1536:NkUk3g2q1/aWh3VEBzpHYQ+dlwODPolxW7Poe74EThbTm6b9KIe:NkUk3g2qVTQqyOkG7vkEThbi6bwIe
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
24adcb317d03c1f3286fd1b2a5520e3c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
DeleteFileA
lstrcpynA
lstrcmpA
lstrcpyA
GetProcAddress
LoadLibraryA
CreateMutexA
GetLocalTime
GetTickCount
GetFileAttributesA
MoveFileA
GetCurrentProcess
EnterCriticalSection
SetFileAttributesA
FindClose
FindNextFileA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryA
FileTimeToSystemTime
ReadFile
SetFilePointer
GetFileSize
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
CreateFileA
WriteFile
UnmapViewOfFile
SystemTimeToFileTime
ReleaseMutex
LeaveCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
GetTempPathA
GetModuleHandleA
FindResourceA
SizeofResource
GetLastError
lstrlenA
MultiByteToWideChar
Sleep
lstrlenW
WideCharToMultiByte
WaitForSingleObject
GetObjectA
CreateDIBSection
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
BitBlt
SelectObject
GdipGetImageEncoders
GdipGetImageEncodersSize
GdiplusShutdown
GdipSaveImageToFile
GdipLoadImageFromFile
GdipCloneImage
GdiplusStartup
GdipFree
GdipDisposeImage
GdipAlloc
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0PBG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Xran@std@@YAXXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
wcscmp
swprintf
_ftol
pow
strtol
_mbsicmp
rand
srand
__dllonexit
_onexit
memcmp
strcat
isalnum
wcslen
_mbsupr
_mbslwr
_itoa
_vsnprintf
memmove
isspace
isalpha
isdigit
strchr
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_strlwr
_unlink
strtok
strcpy
strlen
atoi
strrchr
_beginthreadex
malloc
realloc
fseek
ftell
sprintf
fwrite
strncpy
_wcsupr
fclose
fread
calloc
fopen
__CxxFrameHandler
_purecall
free
memcpy
strcmp
??2@YAPAXI@Z
strstr
memset
wcsncpy
CoTaskMemAlloc
SHDeleteKeyA
IsCharAlphaNumericA
GetDesktopWindow
IsWindow
GetDC
GetClientRect
ReleaseDC
SendMessageA
FindWindowExA
KillTimer
ExitWindowsEx
SetTimer
GetCursorPos
GetKeyState
LoadStringA
LoadStringW
wsprintfA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE