DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f81a7dc44011b2d680b56b694f6ab2d4_JaffaCakes118.dll
Resource
win7-20240221-en
Target
f81a7dc44011b2d680b56b694f6ab2d4_JaffaCakes118
Size
68KB
MD5
f81a7dc44011b2d680b56b694f6ab2d4
SHA1
f9e0a75ee0874059dd28054e6a11d0f6cc69cfd6
SHA256
06b5f65ae44b62df18ae9b74a73b59dc5558e0eff59eb6f487e66058893604ce
SHA512
61f94748b3e393a9e7995094f24f1b22646b4992f34c7d646aa3bda490eab793582b4609f7731938d37179365c9847de7920500f45f54b21b3cfd5fc214d4014
SSDEEP
1536:sder0gq1BoUfqh6rkb/eYYSKNLln7mgO7h0:10lwnbKFl7mP7h
Checks for missing Authenticode signature.
resource |
---|
f81a7dc44011b2d680b56b694f6ab2d4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
lstrlenW
lstrlenA
WideCharToMultiByte
Sleep
Process32Next
Process32First
GetCurrentProcessId
LeaveCriticalSection
GetProcAddress
WritePrivateProfileStringA
GetCommandLineW
ExitProcess
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
LoadLibraryA
FreeLibrary
CreateThread
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
CreateDirectoryA
MoveFileA
EnterCriticalSection
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
atoi
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
fopen
fseek
ftell
fread
fclose
_wcslwr
wcsstr
strncmp
_access
strcat
sprintf
strlen
??3@YAXPAX@Z
strstr
strrchr
memset
strcpy
??2@YAPAXI@Z
_strupr
strchr
memcmp
memcpy
strcmp
strncpy
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ