DllCanUnloadNow
DllRegisterServer
DllUnRegisterServer
ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
1389fee937da02eb2f60a42f2a111583_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1389fee937da02eb2f60a42f2a111583_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
1389fee937da02eb2f60a42f2a111583_JaffaCakes118
Size
109KB
MD5
1389fee937da02eb2f60a42f2a111583
SHA1
6f3192e41fc2343f2818ee59a006ca24d81f0531
SHA256
1e3336159cff77595deea960584a64c1cc06f3aaa043d98bd45b5310913ded97
SHA512
f6ecf123eed3b7ed324b529b28a331c001b37e79c522bc397ff7190fc416633379db29b3a8d385f21f3ddbc5fef60f6deaff7bce00303d2e5a013013efe54337
SSDEEP
3072:S/8nhq7o111ATln1noWWZp9zn6cSRToSfoNC6G+Soy:K8hq7o1E8Zf7zCT5wrXy
Checks for missing Authenticode signature.
resource |
---|
1389fee937da02eb2f60a42f2a111583_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetLastError
CopyFileA
IsBadReadPtr
MapViewOfFile
CreateFileMappingA
MoveFileExA
UnmapViewOfFile
CreateFileA
FlushViewOfFile
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceA
CreateEventA
GetFileSize
GetVersion
lstrlenA
WriteFile
CreateProcessA
GetEnvironmentVariableA
CreatePipe
ReadFile
PeekNamedPipe
GetFileAttributesA
GetCurrentDirectoryA
DeviceIoControl
DeleteFileA
OpenMutexA
TerminateThread
GetWindowsDirectoryA
GetCurrentProcessId
CreateMutexA
GetModuleFileNameA
HeapAlloc
GetProcessHeap
VirtualQueryEx
WriteProcessMemory
HeapFree
VirtualAllocEx
WaitForSingleObject
LoadLibraryA
CreateRemoteThread
FreeLibrary
ReadProcessMemory
VirtualFreeEx
GetProcAddress
GetLastError
GetModuleHandleA
Sleep
CreateThread
WinExec
TerminateProcess
GetSystemDirectoryA
GetCurrentProcess
OpenProcess
Process32Next
CreateToolhelp32Snapshot
Process32First
GetComputerNameA
CloseHandle
GetSystemInfo
GetVersionExA
VirtualFree
MultiByteToWideChar
VirtualAlloc
LCMapStringW
lstrcmpiW
lstrcmpiA
WideCharToMultiByte
ExitWindowsEx
CreateServiceA
RegQueryValueExA
RegOpenKeyExA
SetServiceStatus
GetTokenInformation
RegisterServiceCtrlHandlerA
CryptImportKey
CryptDecrypt
LookupAccountSidW
CryptDestroyKey
CryptHashData
CryptDeriveKey
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
AdjustTokenPrivileges
RegOpenKeyA
LookupPrivilegeValueA
OpenServiceA
QueryServiceStatus
OpenSCManagerA
ChangeServiceConfigA
StartServiceA
ControlService
RegCreateKeyA
RegSetValueExA
CloseServiceHandle
OpenProcessToken
RegEnumKeyA
RegCloseKey
LookupAccountSidA
DeleteService
ConvertStringSidToSidA
CryptAcquireContextA
strncat
_CxxThrowException
strtol
_errno
strncpy
strrchr
wcscpy
_vsnprintf
sscanf
strncmp
free
fclose
fread
fwrite
malloc
fopen
sprintf
strstr
swprintf
atoi
??2@YAPAXI@Z
strchr
rename
time
realloc
fflush
rand
fgets
ftell
fprintf
localtime
printf
??1type_info@@UAE@XZ
??3@YAXPAX@Z
__CxxFrameHandler
_purecall
wcstombs
wcsncpy
_stricmp
_wcsicmp
URLDownloadToFileA
htonl
shutdown
ntohl
inet_ntoa
ntohs
WSAGetLastError
setsockopt
gethostbyname
gethostname
inet_addr
closesocket
__WSAFDIsSet
connect
recv
WSAStartup
WSACleanup
htons
sendto
socket
select
send
InternetGetConnectedState
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
HttpQueryInfoA
InternetReadFile
DllCanUnloadNow
DllRegisterServer
DllUnRegisterServer
ServiceMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ