DllMain
EditAuditInfo
EditOwnerInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor
SedSystemAclEditor
SedTakeOwnership
Behavioral task
behavioral1
Sample
cf50996b8d40e7fbc53f4eec1d346221_JaffaCakes118.dll
Resource
win7-20240704-en
Target
cf50996b8d40e7fbc53f4eec1d346221_JaffaCakes118
Size
152KB
MD5
cf50996b8d40e7fbc53f4eec1d346221
SHA1
3cbaa0957b74ba8ed08c559c549ad3b61c8e8792
SHA256
e848f7d426eaccd9f0dafa1ba2dbb771d17422336a4843293ef4b43b5020fb4a
SHA512
ef21d707e3858ec324abd68f9a50afce90c31fc5feabb339056ffa4f370e939c44359e4ff4e1fbcd7ad1fc1259b1b615626aeb7fc1973a022f3f68a4e9a17e8e
SSDEEP
3072:E6DqP8pkM3B22HJTfpO/o5W8IKTBftonEAUd7j:EmqP8pJBHTROg5bIKTBlAEAi
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
cf50996b8d40e7fbc53f4eec1d346221_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
LocalSize
LocalAlloc
lstrlenA
Sleep
CloseHandle
LocalReAlloc
GetLastError
GetCurrentProcess
GetTickCount
GetProcAddress
GetModuleHandleA
lstrcmpiA
lstrcpyA
InterlockedExchange
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
VirtualQuery
GetCurrentProcessId
GetCurrentThreadId
lstrcmpA
lstrcatA
GetSystemDirectoryA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
ExitProcess
GetExitCodeProcess
SetUnhandledExceptionFilter
GetLocalTime
FormatMessageA
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
GetTempFileNameA
WideCharToMultiByte
GetVersionExA
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
GetProcessTimes
GlobalMemoryStatusEx
FreeLibrary
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
ExpandEnvironmentStringsA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
RaiseException
LoadLibraryA
SysFreeString
StrStrIA
LoadCursorA
CreateWindowExA
MessageBoxA
wvsprintfA
GetWindowRect
DestroyWindow
GetWindow
GetClassNameA
GetCursorInfo
DestroyCursor
CloseWindowStation
wsprintfA
ShowWindow
GetAdaptersInfo
GetUserProfileDirectoryA
GetProfilesDirectoryA
getsockname
gethostname
recv
select
__WSAFDIsSet
ioctlsocket
send
shutdown
connect
gethostbyname
socket
bind
closesocket
listen
WSACleanup
WSAStartup
setsockopt
accept
WSAIoctl
_strlwr
strstr
malloc
realloc
strchr
_ftol
??2@YAPAXI@Z
srand
rand
??3@YAXPAX@Z
__CxxFrameHandler
_except_handler3
strrchr
wcslen
_beginthreadex
strncpy
atoi
??1type_info@@UAE@XZ
_onexit
__dllonexit
_adjust_fdiv
_initterm
_strupr
_wcsicmp
free
_memicmp
_CxxThrowException
strncat
wcsrchr
ceil
memmove
wcstombs
DllMain
EditAuditInfo
EditOwnerInfo
EditPermissionInfo
FMExtensionProcW
SedDiscretionaryAclEditor
SedSystemAclEditor
SedTakeOwnership
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ