DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0d1c5089330659d40f171f19da04eaf6_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d1c5089330659d40f171f19da04eaf6_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
0d1c5089330659d40f171f19da04eaf6_JaffaCakes118
Size
48KB
MD5
0d1c5089330659d40f171f19da04eaf6
SHA1
56cc32b29173a55d7f221bc6283d6715940cedf9
SHA256
05d035b45f198151d53c654bdefce72c4a81e5d22fb9ca7894b1173d82a57fde
SHA512
b83e4052dc856eb5c75a0933bf8c0787ae419407c8efc3ce9fac49ced0a5454e411d95fe55fedb2ae71a5f1cc1ed72b8528c9d1bc8ebd04d68ab36cc61324187
SSDEEP
768:m1SWbVFkuKNC6bQ2SsRwp7cXwvJF2N4fZ00GuVwBwaglGIOLA:qZCuK/U2Op7nvJF2NuBGHw1GIO
Checks for missing Authenticode signature.
resource |
---|
0d1c5089330659d40f171f19da04eaf6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
DeleteFileA
Process32Next
Process32First
GetCommandLineW
WritePrivateProfileStringA
GetSystemDirectoryA
GetWindowsDirectoryA
InterlockedIncrement
DisableThreadLibraryCalls
LeaveCriticalSection
DeleteCriticalSection
InterlockedDecrement
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
Sleep
CreateThread
WideCharToMultiByte
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
CreateEventA
GetLastError
GetLocalTime
InitializeCriticalSection
CloseHandle
DispatchMessageA
FindWindowExA
CreateWindowExA
ShowWindow
SetWindowTextA
IsWindow
CallNextHookEx
RegisterClassExA
KillTimer
SetTimer
PostMessageA
DefWindowProcA
GetMessageA
TranslateMessage
SendMessageA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
_purecall
strstr
_strlwr
strcmp
strchr
fopen
fwrite
free
_initterm
malloc
_adjust_fdiv
_stricmp
memcmp
fclose
??2@YAPAXI@Z
_access
strcat
strcpy
strrchr
rand
strlen
memcpy
memset
??3@YAXPAX@Z
sprintf
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ