DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
44605b5ff25e0268489de428e4665688_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
44605b5ff25e0268489de428e4665688_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
44605b5ff25e0268489de428e4665688_JaffaCakes118
Size
48KB
MD5
44605b5ff25e0268489de428e4665688
SHA1
84aa2b49e8fb38e46da6a1246d49d6911227f61c
SHA256
e679ae231f4c018bcb5eb8753e2a1ed2d81b8bad209137bda08c26a5f3843f16
SHA512
f4c8cf694d2fc556a3001c1223e741878db4e8952937b074523c3e025db5a93bf8cb33db205fa1fc64a0bef85c0e2a7b360a1d6a46eb0958ef61fb9fef59495d
SSDEEP
768:m1SWbVFkuKNC6bQ2SsRwp7cXwvJF2N4fZ00GuVwBwaglGQROLA:qZCuK/U2Op7nvJF2NuBGHw1GQRO
Checks for missing Authenticode signature.
resource |
---|
44605b5ff25e0268489de428e4665688_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
DeleteFileA
Process32Next
Process32First
GetCommandLineW
WritePrivateProfileStringA
GetSystemDirectoryA
GetWindowsDirectoryA
InterlockedIncrement
DisableThreadLibraryCalls
LeaveCriticalSection
DeleteCriticalSection
InterlockedDecrement
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
Sleep
CreateThread
WideCharToMultiByte
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetCurrentProcessId
CreateEventA
GetLastError
GetLocalTime
InitializeCriticalSection
CloseHandle
DispatchMessageA
FindWindowExA
CreateWindowExA
ShowWindow
SetWindowTextA
IsWindow
CallNextHookEx
RegisterClassExA
KillTimer
SetTimer
PostMessageA
DefWindowProcA
GetMessageA
TranslateMessage
SendMessageA
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
_purecall
strstr
_strlwr
strcmp
strchr
fopen
fwrite
free
_initterm
malloc
_adjust_fdiv
_stricmp
memcmp
fclose
??2@YAPAXI@Z
_access
strcat
strcpy
strrchr
rand
strlen
memcpy
memset
??3@YAXPAX@Z
sprintf
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ