DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0b88a84f1b0c2c6c29539ad1688d06d3_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0b88a84f1b0c2c6c29539ad1688d06d3_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
0b88a84f1b0c2c6c29539ad1688d06d3_JaffaCakes118
Size
48KB
MD5
0b88a84f1b0c2c6c29539ad1688d06d3
SHA1
81098389ae9a58bef1ab7fb188c7fbf9775e84ef
SHA256
01b7eec2ab401d96046d8392c4025fd438f7ebd9a46b52151f65555289ea5941
SHA512
15432e9390cdf16c4f87bfb1530755a8de08747c8d65a2296c2987c42928b0477ff1a35f66955dcc958ef1d29179a7f5e71514c17a800449cfd5621f49a728c0
SSDEEP
768:AfX6QbZ59K9DcIh7Yata+bUkZXXtY5oYvI6G0sR3ErP3QuBX:AfKyRm3h7rs+btZXdY5YNEbQu
Checks for missing Authenticode signature.
resource |
---|
0b88a84f1b0c2c6c29539ad1688d06d3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetVersionExA
HeapCreate
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
DeleteFileA
CloseHandle
Process32Next
Process32First
WritePrivateProfileStringA
GetWindowsDirectoryA
GetSystemInfo
GetProcAddress
LoadLibraryA
GetLastError
GetLocalTime
CreateEventA
GetCurrentProcessId
GetCommandLineW
Sleep
CreateThread
WideCharToMultiByte
HeapAlloc
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemDirectoryA
DisableThreadLibraryCalls
PostMessageA
DefWindowProcA
RegisterClassExA
SetWindowTextA
SendMessageA
SetTimer
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindow
CreateWindowExA
ShowWindow
FindWindowExA
KillTimer
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
strrchr
strstr
_strlwr
strlen
strcmp
strchr
fopen
free
_initterm
malloc
_adjust_fdiv
_stricmp
rand
fwrite
fclose
sprintf
_access
memcmp
memcpy
memset
??3@YAXPAX@Z
_purecall
strcpy
??2@YAPAXI@Z
strcat
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ