DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
fb60dcd25cfa202be936b67d0b930d8d_JaffaCakes118.dll
Resource
win7-20240221-en
Target
fb60dcd25cfa202be936b67d0b930d8d_JaffaCakes118
Size
48KB
MD5
fb60dcd25cfa202be936b67d0b930d8d
SHA1
09d2753eaa369cddc6e05231ddb20a3424ea853d
SHA256
799355acbbeecaaf3770f4a839708f65e76985a6c216188137b77a7330c10c0e
SHA512
bb2b19b973edc1a37947aa5f756fd11215f1958d06b209d11bd1fccdbdea5300b971d4efaf42fe46525598f65f6293b15dd85327d2ae93de99c5cd9177d869f6
SSDEEP
768:45GEjZhbTV5GWPsxOH2YxgGiYcjLoqBR9MCSuMffHYQS40RgqvJFc8EdV6K1saij:gG2TfpPs82YxfinjLsfbD4VRFjs6K1bk
Checks for missing Authenticode signature.
resource |
---|
fb60dcd25cfa202be936b67d0b930d8d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
CreateProcessA
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
CreateDirectoryA
LocalFree
Sleep
MoveFileA
DeleteFileA
SetFileAttributesA
GetModuleHandleA
ExitProcess
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CreateThread
Process32Next
Process32First
RemoveDirectoryA
GetCommandLineW
GetShortPathNameA
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetCurrentProcessId
lstrlenW
WritePrivateProfileStringA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcat
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
fopen
fseek
ftell
fread
fclose
atoi
strstr
memcmp
memcpy
??3@YAXPAX@Z
strcmp
strrchr
_purecall
??2@YAPAXI@Z
memset
sprintf
_access
_strlwr
strncpy
strchr
strncmp
strlen
strcpy
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ