DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GameUxShimW
Static task
static1
Behavioral task
behavioral1
Sample
de30aae909b9fa3e36a73cfc078b776d_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
de30aae909b9fa3e36a73cfc078b776d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
de30aae909b9fa3e36a73cfc078b776d_JaffaCakes118
Size
503KB
MD5
de30aae909b9fa3e36a73cfc078b776d
SHA1
365022ea40e4868330358c634003d8acf1cdf339
SHA256
e2cad67e37c6f656a27ceafe12a5f762a53f6cc147dfed645e83e16a78bbccd4
SHA512
6de9906d45b7060a74b1c72fba073d41307831f52156ce80ed924dce527332af9bd738d4ba69771ac768c78337d37a924667f85c5d6f7c060306ae62e1c1687b
SSDEEP
6144:Yokj6gTdZGkqjKoBiTh2wJAi0WomtwGhY/LiGgMgRfJAT9KgyeivWSudVTHpOLmk:ER0kRYiHqi0WomtwGhYDFgmCpIaaRH0d
Checks for missing Authenticode signature.
resource |
---|
de30aae909b9fa3e36a73cfc078b776d_JaffaCakes118 |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
CreateThread
DeleteFileW
DisableThreadLibraryCalls
EnumResourceNamesW
FindResourceW
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetTickCount
HeapAlloc
HeapFree
HeapReAlloc
IsBadStringPtrW
LoadLibraryW
LoadResource
LocalFree
MultiByteToWideChar
RaiseException
SizeofResource
WaitForSingleObject
lstrcmpW
_vsnprintf
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyExW
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
CLSIDFromString
CoCreateGuid
CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoUninitialize
StringFromGUID2
SysAllocString
SysFreeString
VariantClear
SHCreateDirectoryExW
SHGetFolderPathW
StrRChrW
StrToIntW
__acrt_iob_func
__stdio_common_vsprintf
_strdup
free
fwrite
getenv
memcmp
memmove
memset
strchr
strcmp
strcpy
strcspn
strlen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GameUxShimW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ