DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
27aa34ee5306aa2b70c87bc9fb5a20d4_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27aa34ee5306aa2b70c87bc9fb5a20d4_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
27aa34ee5306aa2b70c87bc9fb5a20d4_JaffaCakes118
Size
48KB
MD5
27aa34ee5306aa2b70c87bc9fb5a20d4
SHA1
90c837a39cda25b6e4a76283fa71618bdeda917b
SHA256
01a10330684f1bb454838564cbe6eaea2db487c818ddfb372a9f6bb3696a2d6b
SHA512
5a61dd75755723f0c4854d110a396570b2ed4fd74191f3349bfd789367c70099972158b2a3ed17a244f1f0cbddbab427751e11888d3e00b90dc0c313ec0c4885
SSDEEP
768:JCTygv92rzwd9PYVoQvJExFe98bAh9heDQzupuYAdpYbZX7GJc6pYjZ/0NP70:eXMaamkyecAJeDQtz69l6Aw70
Checks for missing Authenticode signature.
resource |
---|
27aa34ee5306aa2b70c87bc9fb5a20d4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
Process32Next
Process32First
GetLastError
CreateEventA
GetCurrentProcessId
Sleep
CreateThread
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
lstrlenA
GetLocalTime
EnterCriticalSection
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
HeapDestroy
GetShortPathNameA
GetModuleHandleA
InterlockedIncrement
GetModuleFileNameA
CloseHandle
DeleteFileA
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
LeaveCriticalSection
GetWindowsDirectoryA
RegisterClassExA
CallNextHookEx
IsWindow
CreateWindowExA
ShowWindow
SetTimer
SetWindowTextA
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowExA
PostMessageA
DefWindowProcA
KillTimer
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
_purecall
memset
_strlwr
strstr
strcmp
rand
memcpy
free
_initterm
malloc
_adjust_fdiv
_stricmp
memcmp
strlen
strcpy
strcat
strrchr
_access
??2@YAPAXI@Z
??3@YAXPAX@Z
strchr
sprintf
fopen
fclose
fwrite
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ