Initialize
Release
RequestService
Static task
static1
Behavioral task
behavioral1
Sample
d3271fd8e5a6ab1eb0ea9c081e494306_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d3271fd8e5a6ab1eb0ea9c081e494306_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
d3271fd8e5a6ab1eb0ea9c081e494306_JaffaCakes118
Size
64KB
MD5
d3271fd8e5a6ab1eb0ea9c081e494306
SHA1
864a923b93d52c047090de891b9b5c4300a72b20
SHA256
11be0050239e52ccd22d970f59d165ddf2262c0f6eff41fb5c8ff95819148072
SHA512
0e6d0fe3ee9020d0e75495992b8e1a1717fbdbe9001a93f0d96e549a43a1a4aed3711890b6425acf2ae473052817edb18aefaa5958ae5ab529450d6d039d09fd
SSDEEP
768:Opc46CYRz1hrDmEY1u77GmvRer5o6puWV9TyqFiWjUU+t/W0tww30E:W6zx1hrDmEEu3GARer5H3yqiEE
Checks for missing Authenticode signature.
resource |
---|
d3271fd8e5a6ab1eb0ea9c081e494306_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ord941
ord4124
ord6654
ord3658
ord3806
ord2813
ord940
ord1115
ord1173
ord1568
ord1165
ord1570
ord1179
ord342
ord1240
ord1194
ord1563
ord1248
ord1250
ord6466
ord1571
ord600
ord826
ord269
ord540
ord2910
ord350
ord861
ord354
ord3611
ord3122
ord5647
ord927
ord925
ord922
ord538
ord2810
ord860
ord6655
ord4273
ord825
ord823
ord535
ord858
ord537
ord800
sprintf
wcscmp
_wtol
??1type_info@@UAE@XZ
__CxxFrameHandler
?terminate@@YAXXZ
swprintf
wcstombs
_daylight
_timezone
fread
fopen
fclose
_tzset
_ftol
_wtoi
localtime
_wfindfirst
_wfindnext
_EH_prolog
__dllonexit
_onexit
free
_initterm
malloc
_adjust_fdiv
_except_handler3
OpenFileMappingA
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
InitializeCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetCurrentThreadId
LocalAlloc
CloseHandle
GetFileSize
CreateFileA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
LocalFree
MessageBoxW
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?resolveEntity@XercesDOMParser@xercesc_2_7@@UAEPAVInputSource@2@QBG00@Z
?resolveEntity@XercesDOMParser@xercesc_2_7@@UAEPAVInputSource@2@PAVXMLResourceIdentifier@2@@Z
?resetEntities@XercesDOMParser@xercesc_2_7@@UAEXXZ
?expandSystemId@XercesDOMParser@xercesc_2_7@@UAE_NQBGAAVXMLBuffer@2@@Z
?endInputSource@XercesDOMParser@xercesc_2_7@@UAEXABVInputSource@2@@Z
?resetErrors@XercesDOMParser@xercesc_2_7@@UAEXXZ
?error@XercesDOMParser@xercesc_2_7@@UAEXIQBGW4ErrTypes@XMLErrorReporter@2@000JJ@Z
?createElementNSNode@AbstractDOMParser@xercesc_2_7@@MAEPAVDOMElement@2@PBG0@Z
?setPSVIHandler@AbstractDOMParser@xercesc_2_7@@UAEXQAVPSVIHandler@2@@Z
?elementTypeInfo@AbstractDOMParser@xercesc_2_7@@UAEXQBG0@Z
?XMLDecl@AbstractDOMParser@xercesc_2_7@@UAEXQBG000@Z
?startEntityReference@AbstractDOMParser@xercesc_2_7@@UAEXABVXMLEntityDecl@2@@Z
?startElement@AbstractDOMParser@xercesc_2_7@@UAEXABVXMLElementDecl@2@IQBGABV?$RefVectorOf@VXMLAttr@xercesc_2_7@@@2@I_N3@Z
?startDocument@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?resetDocument@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?ignorableWhitespace@AbstractDOMParser@xercesc_2_7@@UAEXQBGI_N@Z
?endEntityReference@AbstractDOMParser@xercesc_2_7@@UAEXABVXMLEntityDecl@2@@Z
?endElement@AbstractDOMParser@xercesc_2_7@@UAEXABVXMLElementDecl@2@I_NQBG@Z
?endDocument@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?docPI@AbstractDOMParser@xercesc_2_7@@UAEXQBG0@Z
?docComment@AbstractDOMParser@xercesc_2_7@@UAEXQBG@Z
?docCharacters@AbstractDOMParser@xercesc_2_7@@UAEXQBGI_N@Z
?setValidationSchemaFullChecking@AbstractDOMParser@xercesc_2_7@@QAEX_N@Z
?setDoSchema@AbstractDOMParser@xercesc_2_7@@QAEX_N@Z
?setDoNamespaces@AbstractDOMParser@xercesc_2_7@@QAEX_N@Z
?setValidationScheme@AbstractDOMParser@xercesc_2_7@@QAEXW4ValSchemes@12@@Z
??0XercesDOMParser@xercesc_2_7@@QAE@QAVXMLValidator@1@QAVMemoryManager@1@QAVXMLGrammarPool@1@@Z
??1XercesDOMParser@xercesc_2_7@@UAE@XZ
?getDocument@AbstractDOMParser@xercesc_2_7@@QAEPAVDOMDocument@2@XZ
?startInputSource@XercesDOMParser@xercesc_2_7@@UAEXABVInputSource@2@@Z
?parse@AbstractDOMParser@xercesc_2_7@@QAEXQBD@Z
?doctypePI@AbstractDOMParser@xercesc_2_7@@UAEXQBG0@Z
?doctypeWhitespace@AbstractDOMParser@xercesc_2_7@@UAEXQBGI@Z
?elementDecl@AbstractDOMParser@xercesc_2_7@@UAEXABVDTDElementDecl@2@_N@Z
?endAttList@AbstractDOMParser@xercesc_2_7@@UAEXABVDTDElementDecl@2@@Z
?endIntSubset@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?endExtSubset@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?entityDecl@AbstractDOMParser@xercesc_2_7@@UAEXABVDTDEntityDecl@2@_N1@Z
?resetDocType@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?startAttList@AbstractDOMParser@xercesc_2_7@@UAEXABVDTDElementDecl@2@@Z
?startIntSubset@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?startExtSubset@AbstractDOMParser@xercesc_2_7@@UAEXXZ
?TextDecl@AbstractDOMParser@xercesc_2_7@@UAEXQBG0@Z
?handleElementPSVI@AbstractDOMParser@xercesc_2_7@@UAEXQBG0PAVPSVIElement@2@@Z
?handlePartialElementPSVI@AbstractDOMParser@xercesc_2_7@@UAEXQBG0PAVPSVIElement@2@@Z
?handleAttributesPSVI@AbstractDOMParser@xercesc_2_7@@UAEXQBG0PAVPSVIAttributeList@2@@Z
?transcode@XMLString@xercesc_2_7@@SAPAGQBD@Z
?fgXercescDefaultLocale@XMLUni@xercesc_2_7@@2QBDB
?Initialize@XMLPlatformUtils@xercesc_2_7@@SAXQBD0QAVPanicHandler@2@QAVMemoryManager@2@_N@Z
?getDOMImplementation@DOMImplementationRegistry@xercesc_2_7@@SAPAVDOMImplementation@2@PBG@Z
?fgMemoryManager@XMLPlatformUtils@xercesc_2_7@@2PAVMemoryManager@2@A
??2XMemory@xercesc_2_7@@SAPAXI@Z
?release@XMLString@xercesc_2_7@@SAXPAPAG@Z
?Terminate@XMLPlatformUtils@xercesc_2_7@@SAXXZ
??3XMemory@xercesc_2_7@@SAXPAX@Z
?attDef@AbstractDOMParser@xercesc_2_7@@UAEXABVDTDElementDecl@2@ABVDTDAttDef@2@_N@Z
?doctypeComment@AbstractDOMParser@xercesc_2_7@@UAEXQBG@Z
?doctypeDecl@AbstractDOMParser@xercesc_2_7@@UAEXABVDTDElementDecl@2@QBG1_N2@Z
?notationDecl@AbstractDOMParser@xercesc_2_7@@UAEXABVXMLNotationDecl@2@_N@Z
Initialize
Release
RequestService
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ