DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
UnInstall
Static task
static1
Behavioral task
behavioral1
Sample
8b5ea4d800861e7dfb4bfcad593e8ca3_JaffaCakes118.dll
Resource
win7-20240704-en
Target
8b5ea4d800861e7dfb4bfcad593e8ca3_JaffaCakes118
Size
349KB
MD5
8b5ea4d800861e7dfb4bfcad593e8ca3
SHA1
ec5379f66dbc66afe09eaa7dc07bcba551f9739d
SHA256
50a04b093c8f05481eb672ebec0537f61e233071798d1f3b939e17e333b51795
SHA512
7a9cb045bb8b811254ff01d5389ec5e4a799ecde5441ddf0b35d52d524c2bfd142da8f5701ed88672fd451866f32cce7ca8c1d409153e7d71678e8a466fb1418
SSDEEP
6144:W323b9t48aRkIzdNrFt9tlZZspbSoA1v3j0ciHMnjKiV6p/KBTA/:W3wb9ukIzdNrZtBkk3EHAWiZBTA
Checks for missing Authenticode signature.
resource |
---|
8b5ea4d800861e7dfb4bfcad593e8ca3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SizeofResource
LoadResource
LockResource
CreateFileW
WriteFile
CloseHandle
CreateThread
lstrcmpiW
MultiByteToWideChar
GetModuleHandleW
RaiseException
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetThreadLocale
SetThreadLocale
FreeLibrary
GetVersionExW
WinExec
OpenProcess
lstrlenA
LoadLibraryW
GetProcAddress
FindResourceW
LoadLibraryExW
GetTickCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLastError
lstrlenW
FindResourceExW
WideCharToMultiByte
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
LoadLibraryA
ExitProcess
HeapSize
Sleep
SetLastError
TlsFree
GetStdHandle
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetProcessHeap
GetVersionExA
GetCommandLineA
GetCurrentThreadId
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
HeapAlloc
HeapReAlloc
InterlockedExchange
RtlUnwind
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
HeapFree
EnumWindows
CharNextW
MessageBoxW
CharLowerA
CharLowerW
GetWindowThreadProcessId
PostMessageW
UnregisterClassA
IsTextUnicode
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
SHGetFolderPathW
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoGetClassObject
StringFromGUID2
CoCreateInstance
VarBstrCmp
RegisterTypeLi
VariantClear
SysAllocStringLen
SysFreeString
VarUI4FromStr
SysAllocString
SysStringByteLen
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarBstrCat
UnRegisterTypeLi
NdrOleFree
NdrStubForwardingFunction
NdrOleAllocate
NdrDllRegisterProxy
NdrDllCanUnloadNow
IUnknown_Release_Proxy
NdrCStdStubBuffer2_Release
IUnknown_AddRef_Proxy
NdrDllGetClassObject
NdrDllUnregisterProxy
IUnknown_QueryInterface_Proxy
InternetSetCookieW
InternetGetCookieW
InternetCloseHandle
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetCrackUrlW
InternetOpenW
CoInternetGetSession
GetModuleBaseNameW
EnumProcesses
EnumProcessModules
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
UnInstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ