DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ea13051996a3c3b42c4b65be189de0ee_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea13051996a3c3b42c4b65be189de0ee_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ea13051996a3c3b42c4b65be189de0ee_JaffaCakes118
Size
48KB
MD5
ea13051996a3c3b42c4b65be189de0ee
SHA1
3e095e110a80793663bed75fd066cb3db9d1b03c
SHA256
b30a095ac15ce3696d07ccadfd7e27d820ec6e2b2a328f37cfb60ec3a88ca726
SHA512
018f8a8cdd9ec5455b4d6c5735ce25ee429de561115f7f93cda78d02d0b6eea069af1aa4cb0e2b8b37dbd1de9f108cd10633cf8c8f6d52787b3bf966bfe5bff9
SSDEEP
768:ZIgKOuPY77lcXHVrHTltnvMjBK4GBXnZ7ReQzvZ4Hk1R70/yjdn+Bs3Wf3efrjZQ:fKLPY77mXHNzlqjBK4GBHoWcGp++3Wfq
Checks for missing Authenticode signature.
resource |
---|
ea13051996a3c3b42c4b65be189de0ee_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
FreeLibrary
LoadLibraryA
GetProcAddress
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
GetCommandLineW
ExitProcess
CreateDirectoryA
GetSystemDirectoryA
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
MoveFileA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
LocalFree
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
WritePrivateProfileStringA
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
CreateThread
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
fseek
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
_purecall
memcpy
strcpy
strncmp
strchr
strncpy
strlen
strcmp
strstr
??3@YAXPAX@Z
sprintf
memset
strrchr
strcat
fclose
fread
??2@YAPAXI@Z
ftell
_stricmp
fopen
memcmp
_access
wcsstr
_wcslwr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ