DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
ef9f0f978e6bec201eaa40d14bae9cb9_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ef9f0f978e6bec201eaa40d14bae9cb9_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
ef9f0f978e6bec201eaa40d14bae9cb9_JaffaCakes118
Size
47KB
MD5
ef9f0f978e6bec201eaa40d14bae9cb9
SHA1
4e4a91d43bc8bf1c545dc32c08a5e84400ffce27
SHA256
9cfafed7dbf8b1f742f1b53fdea52f22a6c66a2ba4186a7cc0d5d99c75f124c1
SHA512
5395aaa4c8f97c259dc283793c1062a970bc1de1a70262003a97d20631e6dc71a7d50bc0b8d35f8ab27605bf385f15b30375b52c21f646cd6b50260c0e39e055
SSDEEP
384:+3oKJm/giUHeL5jRAlnClPzxqIOJYzIJ34Q843V3CoWrm1Q/2:+fwUHk5jOliPzfOqz5QamM
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ef9f0f978e6bec201eaa40d14bae9cb9_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedDecrement
lstrcatA
lstrcpyA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
lstrlenW
GetTempPathA
WideCharToMultiByte
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
lstrlenA
GetShortPathNameA
GetModuleFileNameA
?terminate@@YAXXZ
free
_initterm
malloc
_adjust_fdiv
_except_handler3
memcmp
_purecall
memcpy
__CxxFrameHandler
wcscmp
time
srand
rand
strcat
sprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
fclose
fwrite
fopen
CoCreateInstance
ShellExecuteA
MessageBoxA
CharNextA
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
InternetReadFile
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE