DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ea135a2ce5395816a1b15775345b7b92_JaffaCakes118.dll
Resource
win7-20240221-en
Target
ea135a2ce5395816a1b15775345b7b92_JaffaCakes118
Size
52KB
MD5
ea135a2ce5395816a1b15775345b7b92
SHA1
124b0257ed18cad3605ccca8e53a6702e0fa97f1
SHA256
01070f6408fa263df88bbca4309dcf382cc8ebc26ac81d62f38825d53ea974a7
SHA512
8cff6dbfee7b39ff98540e3c1d0b60bfb957deca506038e6756ddd138cbab7a2fa969a51035e0d8d3c46cb0eb35d2401fb3b4fe8e21f0e12a402f78276f65846
SSDEEP
768:bfZfZABymiZKqSR9neZLch5MDCtZwCXQ3fO5Frs2GirOEDMKO7K0eMFLq:DvGqOoWdtZzGOHqrTK0bLq
Checks for missing Authenticode signature.
resource |
---|
ea135a2ce5395816a1b15775345b7b92_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
LoadLibraryA
CreateThread
FreeLibrary
MoveFileA
SetFileAttributesA
WritePrivateProfileStringA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
Process32First
GetSystemDirectoryA
Sleep
WideCharToMultiByte
GetCommandLineW
ExitProcess
LocalFree
CreateDirectoryA
Process32Next
CloseHandle
DeleteFileA
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
CreateProcessA
SetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
fseek
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
_wcslwr
wcsstr
_access
strncmp
strncpy
strstr
strlen
sprintf
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
fclose
fread
memset
ftell
_strupr
fopen
strcat
strrchr
strcpy
atoi
strchr
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ