DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
Behavioral task
behavioral1
Sample
de2acc158bc26afc65874dc1ff7b26a6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
de2acc158bc26afc65874dc1ff7b26a6_JaffaCakes118
Size
148KB
MD5
de2acc158bc26afc65874dc1ff7b26a6
SHA1
a8f9907e3f877af5185fbd3d51caf880ac2a6bc9
SHA256
c56af15d1f0d087cd7f6abfbc0f892ed04384c6f368de404d40b70eebe046cde
SHA512
d173bf38d98f9a2dfbb9690af0d0ae2e4580f97247e1b8c4c9ee60b13c2b778d5ad533da97c060491141defce0d2654bf2037654432c582d1f585250eb11e35f
SSDEEP
3072:KeJe4bJg+9JKIk1ZEhQ+ZoZfYIQ6ea5ZGGQTBftyN5gaA:KeJeEu+T7k1ehZof/1QTBlA
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
de2acc158bc26afc65874dc1ff7b26a6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
StrStrIA
LoadLibraryA
RaiseException
GetTickCount
InterlockedExchange
Sleep
lstrcatA
GetProcAddress
GetModuleHandleA
CloseHandle
lstrlenA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
GetLastError
CreateFileMappingA
HeapAlloc
lstrcpyA
LocalFree
LocalAlloc
lstrcmpiA
VirtualQuery
GetCurrentProcessId
GetCurrentThreadId
GetShortPathNameA
VirtualAlloc
GetFileAttributesExA
lstrcmpA
GetSystemDirectoryA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetCurrentProcess
GetLongPathNameA
GetModuleFileNameA
ExpandEnvironmentStringsA
LocalReAlloc
ExitProcess
LocalSize
FreeLibrary
GetSystemInfo
GetVersionExA
GetProcessTimes
GlobalMemoryStatusEx
VirtualFree
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
GetTempFileNameA
InitializeCriticalSection
LeaveCriticalSection
GlobalFree
GlobalAlloc
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
SysFreeString
GetCursorInfo
wsprintfA
GetClassNameA
GetWindow
ShowWindow
EnableWindow
GetWindowRect
CloseWindowStation
wvsprintfA
MessageBoxA
CreateWindowExA
DestroyWindow
LoadCursorA
DestroyCursor
GetUserProfileDirectoryA
GetProfilesDirectoryA
GetAdaptersInfo
getsockname
gethostbyname
closesocket
socket
WSACleanup
connect
send
select
recv
gethostname
setsockopt
WSAIoctl
shutdown
WSAStartup
_beginthreadex
__CxxFrameHandler
??3@YAXPAX@Z
strchr
_onexit
__dllonexit
_adjust_fdiv
_initterm
_wcsicmp
_memicmp
_strupr
_stricmp
_strlwr
wcslen
ceil
memmove
??2@YAPAXI@Z
wcstombs
atoi
strncpy
wcsrchr
strncat
strrchr
free
_ftol
srand
rand
malloc
realloc
strstr
_except_handler3
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetClassInfoForCurrentUser
GetDefaultPartitionForCurrentUser
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ