MPACreateComponentInstance
RMACreateInstance
RMAShutdown
Static task
static1
Behavioral task
behavioral1
Sample
fd8df143832b5316afc3a513f62f5b3c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd8df143832b5316afc3a513f62f5b3c_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
fd8df143832b5316afc3a513f62f5b3c_JaffaCakes118
Size
208KB
MD5
fd8df143832b5316afc3a513f62f5b3c
SHA1
a4b564b978f9fac6f1c3901557819542897ae0dd
SHA256
5bb7464ff8de7728832273429bd175bbdb491929c0e9814b6bfb675fb7822ca7
SHA512
4396414bb588280c60112dda169562e8c57d529648ae2a437aa72cdae9c1c2e6b040b3575dd7aedffd0f03c177ce032b47ca3918da992f840a1e7d859e3f5d66
SSDEEP
3072:ACLKgCIxD3BUR9YIcr06WKIU2Ne0hSgUxlp7HVoIpCHjLVLfqcpvLQlKZ:AJIVaR9YVWKIsgMlp71ZpCDRPEsZ
Checks for missing Authenticode signature.
resource |
---|
fd8df143832b5316afc3a513f62f5b3c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
__dllonexit
_onexit
_adjust_fdiv
_initterm
rand
malloc
toupper
tolower
free
calloc
_strdup
_splitpath
_strupr
strstr
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
strncpy
strrchr
_stricmp
_strnicmp
wsprintfA
SHFileOperationA
DisableThreadLibraryCalls
CreateFileA
CloseHandle
lstrcpynA
lstrlenA
GetCurrentDirectoryA
SetCurrentDirectoryA
lstrcatA
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
MoveFileA
GetPrivateProfileStringA
FreeLibrary
lstrcpyA
LoadLibraryA
GetProcAddress
InterlockedIncrement
InterlockedDecrement
GetEnvironmentVariableA
GetModuleFileNameA
MPACreateComponentInstance
RMACreateInstance
RMAShutdown
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ