DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
11b9b6d7083ef9ef8e3cf8e14adc0571_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
11b9b6d7083ef9ef8e3cf8e14adc0571_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
11b9b6d7083ef9ef8e3cf8e14adc0571_JaffaCakes118
Size
48KB
MD5
11b9b6d7083ef9ef8e3cf8e14adc0571
SHA1
30ea6999cf436a585cc224109f208bc1a6e465bc
SHA256
9f42574abb2033ed5efb4def0a1d9ef77ad6c29446062707e427259d0365a057
SHA512
af0992fea603282ddb3f53cc4e1aa2216cd0de2e7ca868682f29de54b0e786977230631077c7984b5f5e14ed3f68a107d672fd157c7316667ed8aa2180bfec06
SSDEEP
768:n5PWl+CSSAbZM3Gte5hQxWr+/6jCJigLSZXNXtHa3RBL9XQO4yU:5PWsrSigXQxyiKbXNdkBL9Xoy
Checks for missing Authenticode signature.
resource |
---|
11b9b6d7083ef9ef8e3cf8e14adc0571_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
DisableThreadLibraryCalls
WritePrivateProfileStringA
CloseHandle
GetLastError
GetCommandLineW
Process32Next
Process32First
CreateEventA
Sleep
CreateThread
WideCharToMultiByte
GetModuleFileNameA
GetSystemDirectoryA
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
GetLocalTime
GetModuleHandleA
DeleteFileA
CreateWindowExA
ShowWindow
SetWindowTextA
SendMessageA
CallNextHookEx
FindWindowExA
IsWindow
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
SetTimer
PostMessageA
DefWindowProcA
RegisterClassExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
memcmp
memcpy
_strlwr
_purecall
strrchr
strchr
fopen
free
_initterm
malloc
_adjust_fdiv
_stricmp
rand
fwrite
fclose
strcat
strcpy
strstr
strlen
??2@YAPAXI@Z
memset
strcmp
??3@YAXPAX@Z
_access
sprintf
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ