DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
00b1316d35bd9d9842a4f5330753f1d2_JaffaCakes118.dll
Resource
win7-20240508-en
Target
00b1316d35bd9d9842a4f5330753f1d2_JaffaCakes118
Size
64KB
MD5
00b1316d35bd9d9842a4f5330753f1d2
SHA1
99a0f23a18c7e4a66ba2cda7f6aaebab655fe02d
SHA256
01d8d9b9ae0fb4f98f31806c0257a46b948cee9947dddaf440a9c328c2254f97
SHA512
727f0db90ff348600cc2490040610a5e1beba5763b0c4b9c126f91140febf15a08e89206f95e1821c1ffa7efc2d4915d72bb7533b127b4236f81d8b42b8192d6
SSDEEP
1536:C5Fa6GQ47jJQpB+nC7TLohy9tnjiT5tIV:0/47jIB0b5tIV
Checks for missing Authenticode signature.
resource |
---|
00b1316d35bd9d9842a4f5330753f1d2_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
FreeLibrary
MoveFileA
CreateThread
CloseHandle
InitializeCriticalSection
GetSystemDirectoryA
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
LocalFree
CreateDirectoryA
Process32Next
Process32First
GetCurrentProcessId
RemoveDirectoryA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
GetModuleFileNameA
Sleep
ExitProcess
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
CreateProcessA
RegCreateKeyExA
RegSetValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
fclose
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strcpy
strchr
atoi
_access
_wcslwr
wcsstr
strcmp
??3@YAXPAX@Z
strstr
memset
strrchr
sprintf
strcat
strlen
memcmp
memcpy
??2@YAPAXI@Z
_stricmp
fread
ftell
fseek
fopen
_purecall
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ