DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetVer
Install
Static task
static1
Behavioral task
behavioral1
Sample
ba58db1209d989910c1ec405e809a7cd_JaffaCakes118.dll
Resource
win7-20240705-en
Target
ba58db1209d989910c1ec405e809a7cd_JaffaCakes118
Size
60KB
MD5
ba58db1209d989910c1ec405e809a7cd
SHA1
4f4f9c9521b4c2a1c6d34071c156724a65aac28a
SHA256
a88f72534e2de790269b8f83dee16994fd2e3682d33c806f008c623e53f713f7
SHA512
d51f045c496b1f0a5d9b3afd070f967c4b4b7dce25252537d84427378abd84073b6831feafbd30d9557ca14bad3e791a6a01527d8b7d24d215670c2e9e9cf2a3
SSDEEP
768:HBanA0SWLZOW+u9FR7G5Bv6eDuHyvqNhQz9d4mwoh3zs:hF0S0JFROv6e7vqu0mfjs
Checks for missing Authenticode signature.
resource |
---|
ba58db1209d989910c1ec405e809a7cd_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameW
FreeLibrary
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
lstrcmpiW
lstrcpynW
GetModuleHandleW
GetProcAddress
LoadLibraryW
lstrcpyW
lstrcatW
DeleteFileA
WinExec
GetBinaryTypeA
GetTickCount
GetTempPathA
WideCharToMultiByte
GetShortPathNameW
lstrlenW
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLocalTime
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleA
CreateThread
Sleep
GetCurrentProcess
HeapDestroy
CloseHandle
CallNextHookEx
CharNextW
CharLowerA
GetMessageW
UnhookWindowsHookEx
SetWindowsHookExW
RegOpenKeyExA
RegQueryValueExW
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegDeleteKeyW
ShellExecuteA
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
LoadRegTypeLi
RegisterTypeLi
VariantClear
SysAllocString
SysFreeString
VarUI4FromStr
LoadTypeLi
SysStringLen
_adjust_fdiv
_stricmp
_initterm
wcscmp
wcslen
calloc
swprintf
_access
rename
fopen
fwrite
fclose
strncmp
strchr
atoi
memcmp
realloc
malloc
free
??2@YAPAXI@Z
memset
sprintf
strcpy
strlen
memcpy
strstr
strcmp
strcat
_splitpath
_purecall
??3@YAXPAX@Z
htons
inet_addr
socket
recv
send
closesocket
gethostbyname
WSAStartup
connect
Netbios
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
InternetReadFile
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetVer
Install
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ