CORLockDownProvider
CORPolicyEE
CORPolicyProvider
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
JaffaCakes118_6438374da1cd51af7d65bf3d3ccc6ed5.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6438374da1cd51af7d65bf3d3ccc6ed5.dll
Resource
win10v2004-20250217-en
Target
JaffaCakes118_6438374da1cd51af7d65bf3d3ccc6ed5
Size
512KB
MD5
6438374da1cd51af7d65bf3d3ccc6ed5
SHA1
e0e01af69fe21d7f4bc990ac6b93c1237a3de5d2
SHA256
3a57565bc9b68c8b8383d82410cb8daf820b0ec536e263f20071add4808cb7fc
SHA512
ea4e41b684e5fa63e8e0104c6e77da86b4c989f6eccc83ac5ab461578ce598519255c813cebc5579dd2af32fed5b2e1dcc8d1ae35bfd79ee0316c0138fe3e1f7
SSDEEP
3072:iRmPV0GCs+G2ZCoXbkL4G6MS4ZIfwCIpTBftdDKT4bw3k/zvUJiFWFl7:igPPAH7MlefwCIpTBldDK0F/zvUJGUR
resource | yara_rule |
---|---|
sample | family_gh0strat |
Checks for missing Authenticode signature.
resource |
---|
JaffaCakes118_6438374da1cd51af7d65bf3d3ccc6ed5 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SHDeleteKeyA
lstrcmpiA
MultiByteToWideChar
FreeLibrary
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
InterlockedExchange
LeaveCriticalSection
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetCurrentThreadId
GetSystemDirectoryA
InitializeCriticalSection
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
HeapFree
GetProcessHeap
GetLastError
DeleteFileA
RemoveDirectoryA
ExitThread
GetShortPathNameA
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
GetCurrentProcessId
GetCommandLineA
VirtualQuery
GetFileAttributesExA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
ExitProcess
GetLocalTime
GetTempFileNameA
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
LoadLibraryA
RaiseException
LocalAlloc
GetModuleHandleA
GetProcAddress
HeapAlloc
wvsprintfA
GetCursorInfo
PtInRect
DestroyCursor
LoadCursorA
MessageBoxA
DestroyWindow
CreateWindowExA
GetWindowRect
EnableWindow
ShowWindow
GetWindow
GetClassNameA
SendMessageTimeoutA
CopyRect
wsprintfA
CloseWindowStation
RegisterServiceCtrlHandlerExA
RegSaveKeyA
RegOpenKeyExW
RegRestoreKeyA
_adjust_fdiv
_initterm
_stricmp
_strupr
_wcsicmp
_strlwr
_memicmp
ceil
strncat
wcslen
__dllonexit
_onexit
realloc
strrchr
rand
srand
time
__CxxFrameHandler
_ftol
strchr
strncpy
_beginthreadex
_except_handler3
free
malloc
atoi
memmove
wcstombs
_callnewh
CORLockDownProvider
CORPolicyEE
CORPolicyProvider
DllCanUnloadNow
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ