DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
38975098c99330c8848c5d2e7517d9f0_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
38975098c99330c8848c5d2e7517d9f0_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
38975098c99330c8848c5d2e7517d9f0_JaffaCakes118
Size
48KB
MD5
38975098c99330c8848c5d2e7517d9f0
SHA1
6a13d060c43642acab339a5abd59909cede233c6
SHA256
e0204d0ece1361a7235426dbf6d5d2b107e0130846807144ab1094325ffdaff5
SHA512
42f88c0da0951f9d19f8496dc8b2a53853ca1fc8ca72a998a4fea7d679e0eb30a5649c0dda8ecea411550bec4094c08aea080595c5ac310d90963bd6c0cbc41b
SSDEEP
768:m1SWbVFkuKNC6bQ2SsRwp7cXwvJF2N4fZ00GuVwBwaglGqOLA:qZCuK/U2Op7nvJF2NuBGHw1GqO
Checks for missing Authenticode signature.
resource |
---|
38975098c99330c8848c5d2e7517d9f0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
DeleteFileA
Process32Next
Process32First
GetCommandLineW
WritePrivateProfileStringA
GetSystemDirectoryA
GetWindowsDirectoryA
InterlockedIncrement
DisableThreadLibraryCalls
LeaveCriticalSection
DeleteCriticalSection
InterlockedDecrement
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
Sleep
CreateThread
WideCharToMultiByte
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
CreateEventA
GetLastError
GetLocalTime
InitializeCriticalSection
CloseHandle
DispatchMessageA
FindWindowExA
CreateWindowExA
ShowWindow
SetWindowTextA
IsWindow
CallNextHookEx
RegisterClassExA
KillTimer
SetTimer
PostMessageA
DefWindowProcA
GetMessageA
TranslateMessage
SendMessageA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
_purecall
strstr
_strlwr
strcmp
strchr
fopen
fwrite
free
_initterm
malloc
_adjust_fdiv
_stricmp
memcmp
fclose
??2@YAPAXI@Z
_access
strcat
strcpy
strrchr
rand
strlen
memcpy
memset
??3@YAXPAX@Z
sprintf
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ