DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
32d45ba7146d8533c16cbc25fc7444ec_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
32d45ba7146d8533c16cbc25fc7444ec_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
32d45ba7146d8533c16cbc25fc7444ec_JaffaCakes118
Size
142KB
MD5
32d45ba7146d8533c16cbc25fc7444ec
SHA1
2faf8e625e148e4206d27eed2b8d7678e217a1c4
SHA256
27e8a3038e06e0d85e81b352d2882cf3f04e72319eabcd6a2384c82adab6d8f2
SHA512
a303fcaaae279922d334eda21840bc3fb702e6cbbc78989373aa84f0ecd598cbb055bc837361e86813cb5b1a2131d6025354f032020f7a11a2ff84b9b1638553
SSDEEP
1536:Rbw/Daz5EvK2AXfUYSxD2XWYao8bUyn9gRyVTVy9D1ZNngeZWFEdSAdNITJ:Rbw/B3YJwiVaUig0VTVy9jEMSAdNIT
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
32d45ba7146d8533c16cbc25fc7444ec_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteFileA
GetProcAddress
LoadLibraryA
GetTempPathA
GetLocalTime
GetTickCount
GetFileAttributesA
MoveFileA
GetCurrentProcess
CloseHandle
FindClose
FindNextFileA
FindFirstFileA
RemoveDirectoryA
CreateDirectoryA
FileTimeToSystemTime
ReadFile
SetFilePointer
GetFileSize
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
CreateFileA
WriteFile
UnmapViewOfFile
SystemTimeToFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
GetModuleFileNameA
DisableThreadLibraryCalls
GetModuleHandleA
FindResourceA
SizeofResource
GetLastError
lstrlenA
MultiByteToWideChar
Sleep
lstrlenW
WideCharToMultiByte
WaitForSingleObject
SetFileAttributesA
ReleaseMutex
GetObjectA
CreateDIBSection
DeleteObject
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GdipGetImageEncoders
GdiplusShutdown
GdipSaveImageToFile
GdipLoadImageFromFile
GdiplusStartup
GdipFree
GdipDisposeImage
GdipAlloc
GdipCloneImage
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?at@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Xran@std@@YAXXZ
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PAD0PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0PBG@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBDI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
strstr
_unlink
_strlwr
_adjust_fdiv
_initterm
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
srand
rand
_mbsicmp
strtol
pow
_ftol
swprintf
wcscmp
strtok
atoi
strrchr
_beginthreadex
malloc
realloc
fwrite
fseek
ftell
sprintf
strncpy
_wcsupr
wcsncpy
strchr
isdigit
isalpha
isspace
memmove
fclose
fread
calloc
fopen
__CxxFrameHandler
_purecall
free
memcpy
strcmp
??2@YAPAXI@Z
_itoa
memset
strlen
strcpy
memcmp
strcat
isalnum
wcslen
_mbsupr
_mbslwr
_vsnprintf
LoadStringW
LoadStringA
wsprintfA
ExitWindowsEx
FindWindowExA
SendMessageA
ReleaseDC
GetClientRect
GetDC
IsWindow
GetDesktopWindow
GetCursorPos
IsCharAlphaNumericA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE