DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4304d649295a095a053fbea5f4a54512_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4304d649295a095a053fbea5f4a54512_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
4304d649295a095a053fbea5f4a54512_JaffaCakes118
Size
48KB
MD5
4304d649295a095a053fbea5f4a54512
SHA1
46b094a6e8dbe47241f6ea6a590353e688e6ea46
SHA256
66271cd115e356d945d3df82ee3824e7f33bea60f07796c2fa1f47d66f6690e6
SHA512
eb11877650b262a2ce5ea80c8d6f418370735a07c4e484b75999b049c4d75be1f43decb267049cbd9831ebd64f5c23fc62f772c26ccca9d162d4b3f0a475197d
SSDEEP
768:dfghQclae2w0gPzs5+92tQl7YHLwbZw+e1snNVwq435cFFuIA:do6mae2w0gbs5+9Zl72LSFxDZ40dA
Checks for missing Authenticode signature.
resource |
---|
4304d649295a095a053fbea5f4a54512_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetLastError
GetLocalTime
GetSystemDirectoryA
WritePrivateProfileStringA
CreateEventA
GetCurrentProcessId
GetCommandLineW
GetWindowsDirectoryA
LeaveCriticalSection
EnterCriticalSection
Sleep
CreateThread
WideCharToMultiByte
lstrlenW
lstrlenA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
DeleteFileA
Process32First
Process32Next
CloseHandle
MultiByteToWideChar
GetModuleFileNameA
CreateWindowExA
ShowWindow
CallNextHookEx
KillTimer
SetTimer
SetWindowTextA
SendMessageA
GetMessageA
TranslateMessage
DispatchMessageA
FindWindowExA
PostMessageA
RegisterClassExA
IsWindow
DefWindowProcA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CommandLineToArgvW
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
memcmp
memcpy
_strlwr
_purecall
strchr
fopen
fwrite
free
_initterm
malloc
_adjust_fdiv
_stricmp
rand
fclose
strcmp
strcat
strrchr
??2@YAPAXI@Z
strstr
_access
strcpy
??3@YAXPAX@Z
sprintf
memset
strlen
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ