DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0083649bb900e6f630a312d2ddecf21a_JaffaCakes118.dll
Resource
win7-20240220-en
Target
0083649bb900e6f630a312d2ddecf21a_JaffaCakes118
Size
52KB
MD5
0083649bb900e6f630a312d2ddecf21a
SHA1
01b1269b4c4e7dde6fed986965d988b2e456e885
SHA256
46160fb02866a4720baf414d8f079f3eb8540b3ef1a305a1cd57ad064cff1d4b
SHA512
2d2fafb2fca6c27894d6ec3b4143ce0a58709394165aee6a3f1956fd083fef52b72fd26ac5e7bce18414b186ec04c743fda3648c8d4f8fd50b08ea50b08d1021
SSDEEP
1536:J8VZC6KbHiFOYrHwD343YxAcc8/yNEmGo5QT:qVc6Prws3UmGo5a
Checks for missing Authenticode signature.
resource |
---|
0083649bb900e6f630a312d2ddecf21a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
WaitForSingleObject
GetSystemDirectoryA
GetCurrentProcessId
CreateThread
MoveFileA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
GetExitCodeProcess
GetShortPathNameA
GetModuleHandleA
ExitProcess
WritePrivateProfileStringA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
Process32Next
Process32First
GetCommandLineW
DeleteFileA
RemoveDirectoryA
CreateProcessA
SetFileAttributesA
LocalFree
CreateDirectoryA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
MultiByteToWideChar
lstrlenA
HeapDestroy
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
wcsstr
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_purecall
memcpy
atoi
strrchr
??3@YAXPAX@Z
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
strstr
??2@YAPAXI@Z
_stricmp
_wcslwr
memcmp
_access
strcat
strcmp
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ