DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f4de8fa3a5a82323bb807316b68a533c_JaffaCakes118.dll
Resource
win7-20240319-en
Target
f4de8fa3a5a82323bb807316b68a533c_JaffaCakes118
Size
76KB
MD5
f4de8fa3a5a82323bb807316b68a533c
SHA1
3697f681b0da753e0dd38a91d0fafa1440c5355f
SHA256
51ed7e9e6ee0bf18d6382f3c81182b10d214063e1d164445b0baf61fb4c0ae93
SHA512
2fd3e52d725d70d1b6309f2d46d39a0daecc66b9b25183cd943ce2fa3bd0da1a092e7c0fb670553829a10ce73d6ddecd464a94679a5035f4be0e61b46787bd98
SSDEEP
1536:LXNDiKH9XgtFlf6Ehli/oLifnWmi0gCNqJ8:diWXgRLhhLivi0g8M8
Checks for missing Authenticode signature.
resource |
---|
f4de8fa3a5a82323bb807316b68a533c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
WideCharToMultiByte
MoveFileA
CloseHandle
GetSystemDirectoryA
HeapDestroy
GetExitCodeProcess
WaitForSingleObject
LocalFree
ExitProcess
CreateThread
GetCommandLineW
WritePrivateProfileStringA
GetCurrentProcessId
Process32Next
Process32First
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
RemoveDirectoryA
CreateProcessA
LoadLibraryA
GetProcAddress
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
Sleep
FindNextFileA
CreateDirectoryA
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strcat
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strcmp
atoi
fopen
fseek
ftell
fread
fclose
sprintf
strstr
strncpy
strchr
memset
strncmp
strlen
strcpy
??3@YAXPAX@Z
strrchr
_stricmp
_access
memcpy
_purecall
??2@YAPAXI@Z
memcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ