DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
01f909f9523c40e30289103948555541_JaffaCakes118.dll
Resource
win7-20240508-en
Target
01f909f9523c40e30289103948555541_JaffaCakes118
Size
52KB
MD5
01f909f9523c40e30289103948555541
SHA1
f6f44fb46afe7c260ce0fc9b6122e710ed9565fa
SHA256
558bc2a5708e9df25a5da71ecf405e82ac348c3e34b98c8bcbacc1d3e4f01c0f
SHA512
944a22c005e19c1c17cfedc0020e6bdd77e2a1b8372beb47d6db633a2a1f6d321dfa8e194203924fcd9c6ed2e741735c7141ada42dcd5509ee1f5ce46d8569f7
SSDEEP
768:UofW4wMkvnmlx2jA3fc81BAImgANbZfms9I+Dd6WRSrPZU7mQAlfdhJkq3FR4fqK:9W4wMamijAfpiPlfxVSZUCldo6R
Checks for missing Authenticode signature.
resource |
---|
01f909f9523c40e30289103948555541_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
LeaveCriticalSection
EnterCriticalSection
LocalFree
GetCurrentProcessId
FreeLibrary
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateThread
WritePrivateProfileStringA
MoveFileA
CreateDirectoryA
ExitProcess
Sleep
LoadLibraryA
GetProcAddress
Process32First
Process32Next
CloseHandle
RemoveDirectoryA
CreateProcessA
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
lstrlenA
DeleteFileA
MultiByteToWideChar
SetFileAttributesA
BuildExplicitAccessWithNameA
RegSetValueExA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
VariantClear
SysAllocString
SysFreeString
SysStringLen
LoadRegTypeLi
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
fseek
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
strncmp
strncpy
strchr
atoi
strstr
strlen
strcmp
_access
strcpy
_wcslwr
wcsstr
memcpy
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
_strlwr
fopen
strcat
strrchr
sprintf
memcmp
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ