NSGetModule
SU_Uninstall
Static task
static1
Behavioral task
behavioral1
Sample
da13453cf60ff1bbb09e4f21cbb81fda_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da13453cf60ff1bbb09e4f21cbb81fda_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
da13453cf60ff1bbb09e4f21cbb81fda_JaffaCakes118
Size
248KB
MD5
da13453cf60ff1bbb09e4f21cbb81fda
SHA1
dcc723d80b4cb04970b74575f87a4c8146a2c13d
SHA256
0efbffa1a3101e68a4b7e9ba3ea126c97e80ed3c1983e9d85850e73381e18f86
SHA512
7d96a144b4b22b6887e391d82d3cb22395de4e7b4304c411fbf89293f1920abfb6254f0e3ac9940b0054cef6e228f85818e7f85b19486904188c2e4847d14365
SSDEEP
6144:38Sa2X1fV2h18TBp/IVhhn4IFj79cwKBj:sSa2X14h18T3IVhvp9H8j
Checks for missing Authenticode signature.
resource |
---|
da13453cf60ff1bbb09e4f21cbb81fda_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
JS_AddRoot
JS_RemoveRoot
JS_Init
JS_EvaluateScript
JS_DestroyContextMaybeGC
JS_Finish
JS_NewContext
JS_SetErrorReporter
JS_BeginRequest
JS_DestroyContext
JS_InitStandardClasses
JS_EndRequest
JS_Enumerate
JS_IdToValue
JS_GetUCProperty
JS_GetStringBytes
JS_DestroyIdArray
JS_TypeOfValue
JS_PopArguments
JS_GetContextPrivate
JS_LookupProperty
JS_FinalizeStub
JS_InitClass
JS_NewDoubleValue
JS_EnumerateStub
JS_ResolveStub
JS_CallFunctionValue
JS_PushArguments
JS_DefineProperty
JS_DefineProperties
JS_DefineFunctions
JS_DefineConstDoubles
JS_PropertyStub
JS_SetProperty
JS_ValueToECMAUint32
JS_ReportWarning
JS_NewStringCopyZ
JS_ValueToECMAInt32
JS_SuspendRequest
JS_AddNamedRoot
JS_GetOptions
JS_ResumeRequest
JS_GetInstancePrivate
JS_ValueToInt32
JS_InstanceOf
JS_ValueToBoolean
JS_ReportError
JS_NewUCStringCopyN
JS_ValueToString
JS_GetStringChars
JS_GetPrivate
JS_GetGlobalObject
JS_GetProperty
JS_GetClass
JS_NewUCStringCopyZ
JS_SetUCProperty
JS_NewObject
JS_ConvertStub
JS_SetPrivate
?ToCString@nsString@@QBEPADPADII@Z
?Assign@nsSubstring@@QAEXABVnsAString_internal@@@Z
?Replace@nsCSubstring@@QAEXIIABVnsCSubstringTuple@@@Z
?Equals@nsCSubstring@@QBEHPBD@Z
?Equals@nsSubstring@@QBEHABV1@@Z
?CompressWhitespace@nsCString@@QAEXHH@Z
??0nsSupportsWeakReference@@QAE@XZ
??1nsSupportsWeakReference@@IAE@XZ
?GetWeakReference@nsSupportsWeakReference@@UAGIPAPAVnsIWeakReference@@@Z
??_7nsDefaultStringComparator@@6B@
?StringBeginsWith@@YAHABVnsAString_internal@@0ABVnsStringComparator@@@Z
?Equals@nsSubstring@@QBEHPBG@Z
?Compare@nsCString@@QBEHPBDHH@Z
PL_InitEvent
?FindChar@nsCSubstring@@QBEHDI@Z
?EmptyCString@@YAABVnsCString@@XZ
?CopyUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?Rebind@nsDependentSubstring@@QAEXABVnsSubstring@@II@Z
?SetLength@nsACString_internal@@QAEXI@Z
?AppendUTF16toUTF8@@YAXPBGAAVnsACString_internal@@@Z
?AssignWithConversion@nsCString@@QAEXPBGH@Z
?SetCapacity@nsCSubstring@@QAEXI@Z
?ReplaceChar@nsCString@@QAEXPBDD@Z
?ToNewCString@@YAPADABVnsACString_internal@@@Z
?EnsureMutable@nsCSubstring@@IAEXXZ
?Assign@nsAString_internal@@QAEXABVnsSubstringTuple@@@Z
??1nsHashKey@@UAE@XZ
?Write@nsHashKey@@UBEIPAVnsIObjectOutputStream@@@Z
?AppendInt@nsString@@QAEXHH@Z
??0nsCreateInstanceByContractID@@QAE@PBDPAVnsISupports@@PAI@Z
?strcmp@nsCRT@@SAHPBD0@Z
?assign_from_helper@nsCOMPtr_base@@QAEXABVnsCOMPtr_helper@@ABUnsID@@@Z
?RemoveElementsAt@nsVoidArray@@QAEHHH@Z
?NS_NewGenericModule2@@YAIPBUnsModuleInfo@@PAPAVnsIModule@@@Z
??0nsCreateInstanceByCID@@QAE@ABUnsID@@PAVnsISupports@@PAI@Z
?strlen@nsCRT@@SAIPBG@Z
?CallCreateInstance@@YAIABUnsID@@PAVnsISupports@@0PAPAX@Z
NS_Free_P
?NS_CopyUnicodeToNative@@YAIABVnsAString_internal@@AAVnsACString_internal@@@Z
?CopyASCIItoUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?Equals@nsAString_internal@@QBEHABV1@ABVnsStringComparator@@@Z
?Rebind@nsDependentCSubstring@@QAEXABVnsCSubstring@@II@Z
??1nsHashtable@@UAE@XZ
??0nsHashtable@@QAE@IH@Z
NS_NewNativeLocalFile_P
??1nsVoidArray@@UAE@XZ
??0nsVoidArray@@QAE@XZ
?Clear@nsVoidArray@@UAEXXZ
?SizeTo@nsVoidArray@@UAEHH@Z
?Compact@nsVoidArray@@UAEXXZ
?GrowArrayBy@nsVoidArray@@MAEHH@Z
?AppendWithConversion@nsString@@QAEXPBDH@Z
?free@nsCRT@@SAXPAD@Z
?AssignWithConversion@nsCString@@QAEXABVnsAString_internal@@@Z
?ToNewCString@@YAPADABVnsAString_internal@@@Z
?strdup@nsCRT@@SAPADPBD@Z
?RFindChar@nsString@@QBEHGHH@Z
?AppendWithConversion@nsString@@QAEXABVnsACString_internal@@@Z
?AssignASCII@nsSubstring@@QAEXPBD@Z
NS_NewLocalFile_P
?assign_from_qi_with_error@nsCOMPtr_base@@QAEXABVnsQueryInterfaceWithError@@ABUnsID@@@Z
?AssignWithConversion@nsString@@QAEXPBDH@Z
?InsertElementAt@nsVoidArray@@QAEHPAXH@Z
?NS_CopyNativeToUnicode@@YAIABVnsACString_internal@@AAVnsAString_internal@@@Z
?Get@nsHashtable@@QAEPAXPAVnsHashKey@@@Z
?NS_GetProxyForObject@@YAIPAVnsIEventQueue@@ABUnsID@@PAVnsISupports@@HPAPAX@Z
?AppendUTF8toUTF16@@YAXABVnsACString_internal@@AAVnsAString_internal@@@Z
?AppendUTF16toUTF8@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?AppendASCIItoUTF16@@YAXPBDAAVnsAString_internal@@@Z
?LossyAppendUTF16toASCII@@YAXABVnsAString_internal@@AAVnsACString_internal@@@Z
?FindChar@nsSubstring@@QBEHGI@Z
?Length@nsAString_internal@@QBEIXZ
?strcasecmp@nsCRT@@SAHPBD0@Z
?EqualsASCII@nsSubstring@@QBEHPBDI@Z
?CallGetService@@YAIABUnsID@@0PAPAX@Z
?AssignASCII@nsSubstring@@QAEXPBDI@Z
?assign_from_gs_cid@nsCOMPtr_base@@QAEXVnsGetServiceByCID@@ABUnsID@@@Z
?assign_from_qi@nsCOMPtr_base@@QAEXVnsQueryInterface@@ABUnsID@@@Z
?assign_with_AddRef@nsCOMPtr_base@@QAEXPAVnsISupports@@@Z
?ElementAt@nsVoidArray@@QBEPAXH@Z
?Reset@nsHashtable@@QAEXXZ
?Find@nsString@@QBEHPBDHHH@Z
?Put@nsHashtable@@QAEPAXPAVnsHashKey@@PAX@Z
?EmptyString@@YAABVnsString@@XZ
?Init@nsPromiseFlatString@@AAEXABVnsAString_internal@@@Z
?Adopt@nsCSubstring@@QAEXPADI@Z
?Assign@nsCSubstring@@QAEXABV1@@Z
?Assign@nsCSubstring@@QAEXPBDI@Z
?Adopt@nsSubstring@@QAEXPAGI@Z
?Mid@nsString@@QBEIAAV1@II@Z
?Assign@nsSubstring@@QAEXABVnsSubstringTuple@@@Z
?Assign@nsSubstring@@QAEXABV1@@Z
?Assign@nsSubstring@@QAEXPBGI@Z
??1nsAString_internal@@QAE@XZ
?ReplaceASCII@nsCSubstring@@QAEXIIPBDI@Z
?sEmptyBuffer@?$nsCharTraits@G@@2PBGB
?SetLength@nsSubstring@@QAEXI@Z
?ReplaceASCII@nsSubstring@@QAEXIIPBDI@Z
?Replace@nsSubstring@@QAEXIIPBGI@Z
?sCanonicalVTable@nsObsoleteAString@@2PBXB
?assign_from_gs_contractid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByContractIDWithError@@ABUnsID@@@Z
?assign_from_gs_cid_with_error@nsCOMPtr_base@@QAEXABVnsGetServiceByCIDWithError@@ABUnsID@@@Z
?assign_from_gs_contractid@nsCOMPtr_base@@QAEXVnsGetServiceByContractID@@ABUnsID@@@Z
??1nsACString_internal@@QAE@XZ
?sEmptyBuffer@?$nsCharTraits@D@@2PBDB
?SetLength@nsCSubstring@@QAEXI@Z
?Replace@nsCSubstring@@QAEXIIPBDI@Z
?sCanonicalVTable@nsObsoleteACString@@2PBXB
??1nsCOMPtr_base@@QAE@XZ
?CallGetService@@YAIPBDABUnsID@@PAPAX@Z
?SafeElementAt@nsVoidArray@@QBEPAXH@Z
PR_Calloc
PR_smprintf_free
PR_smprintf
PR_Malloc
PR_AtomicIncrement
PR_AtomicDecrement
PR_snprintf
PR_sscanf
PR_DestroyLock
PR_Realloc
PR_sprintf_append
PR_GetCurrentThread
PR_LocalTimeParameters
PR_Now
PR_ExplodeTime
PR_FormatTimeUSEnglish
PR_Free
PR_Close
PR_Seek
PR_Write
PR_Read
PR_CreateThread
PR_NewLock
PR_Lock
PR_Unlock
PL_strchr
PL_strfree
PL_strncasecmp
PL_strdup
PL_strlen
_VR_SetRefCount@8
_VR_Remove@4
_VR_GetUninstallUserName@12
_VR_GetRefCount@8
_VR_SetRegDirectory@4
_VR_Close@0
_NR_ShutdownRegistry@0
??0nsFileSpec@@QAE@XZ
??0nsFileURL@@QAE@PBDH@Z
??4nsFileSpec@@QAEXABVnsFileURL@@@Z
_VR_UninstallDestroy@4
_VR_UninstallDeleteSharedFilesKey@4
_VR_UninstallEnumSharedFiles@16
_VR_UninstallDeleteFileFromList@8
?close@nsOutputStream@@QAEIXZ
??6nsOutputStream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
??6nsOutputStream@@QAEAAV0@H@Z
?nsEndl@@YAAAVnsOutputStream@@AAV1@@Z
??6nsOutputStream@@QAEAAV0@PBD@Z
??6nsOutputFileStream@@QAEAAVnsOutputStream@@P6AAAV1@AAV1@@Z@Z
??0nsFileSpec@@QAE@PBDH@Z
?flush@nsOutputFileStream@@UAEIXZ
?abort@nsOutputFileStream@@UAEXXZ
?set_at_eof@nsRandomAccessStoreClient@@MAEXH@Z
?get_at_eof@nsRandomAccessStoreClient@@MBEHXZ
?seek@nsRandomAccessStoreClient@@QAEX_J@Z
?GetFileSize@nsFileSpec@@QBEIXZ
??0nsOutputFileStream@@QAE@ABVnsFileSpec@@HH@Z
??1nsOutputFileStream@@UAE@XZ
_NR_RegClose@4
_NR_RegSetEntry@24
_NR_RegGetUniqueName@12
_NR_RegAddKey@16
_NR_RegOpen@8
_NR_RegDeleteKey@12
_NR_StartupRegistry@0
_VR_Install@16
_VR_UninstallCreateNode@8
_VR_GetPath@12
_VR_GetDefaultDirectory@12
_VR_ValidateComponent@4
_VR_GetVersion@8
??1nsFileSpec@@UAE@XZ
?NS_FileSpecToIFile@@YAIPAVnsFileSpec@@PAPAVnsILocalFile@@@Z
??1nsFileURL@@UAE@XZ
_VR_Enum@16
LoadLibraryExA
GetPrivateProfileStringA
MultiByteToWideChar
GetVersion
lstrcatA
lstrcpyA
WritePrivateProfileStringA
MoveFileExA
IsDBCSLeadByte
CopyFileA
LoadLibraryA
GetProcAddress
FreeLibrary
GetShortPathNameA
CreateDirectoryA
DisableThreadLibraryCalls
GetVersionExA
CharToOemA
RegDeleteKeyA
RegEnumKeyA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
CoInitialize
CoCreateInstance
CoUninitialize
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
?_Nomemory@std@@YAXXZ
fseek
memset
??3@YAXPAX@Z
free
malloc
strlen
??_V@YAXPAX@Z
_purecall
sprintf
printf
memcmp
fclose
calloc
fwrite
__CppXcptFilter
fread
fopen
strcat
strncmp
strcmp
memcpy
tolower
_callnewh
__dllonexit
_onexit
_initterm
_adjust_fdiv
_except_handler3
NSGetModule
SU_Uninstall
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE