DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
04af7a14690a1ec9d461c929d9c041ed_JaffaCakes118.dll
Resource
win7-20240221-en
Target
04af7a14690a1ec9d461c929d9c041ed_JaffaCakes118
Size
60KB
MD5
04af7a14690a1ec9d461c929d9c041ed
SHA1
e87df6088a7a4443d902d710c7dc57c41e85b7b3
SHA256
339c03eee834e7b2ef41c783820c6e212fb5a2c02ad7555e4b1d3240017d3d9c
SHA512
8d50ee00d19e7b322801e465e6e013fc52c15193d6e698a6e7331ab4950cff4264e227f6f0d5888c09da06c6d7a6547d1c2c41f9b031f50c611ace76145794fc
SSDEEP
768:wcDPZ+6C9q22j0nGeYFNqaPa0RkPs3auRoxKKJvd2/8oWViLX9iMeFKDon/TQTfr:wkLfl4nGPBaMLRRsx/2EzUtNGVn/kTS
Checks for missing Authenticode signature.
resource |
---|
04af7a14690a1ec9d461c929d9c041ed_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
CreateProcessA
RemoveDirectoryA
GetCurrentProcessId
GetProcAddress
LoadLibraryA
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
CreateThread
GetExitCodeProcess
CloseHandle
Sleep
GetSystemDirectoryA
Process32Next
Process32First
ExitProcess
CreateDirectoryA
FreeLibrary
LocalFree
MoveFileA
GetCommandLineW
WideCharToMultiByte
DeleteFileA
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
WaitForSingleObject
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoUninitialize
SysFreeString
LoadRegTypeLi
SysStringLen
VariantClear
SysAllocString
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
fclose
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
_wcslwr
wcsstr
_access
strcpy
strncmp
strchr
strncpy
strstr
strlen
strrchr
strcat
sprintf
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
_strupr
fread
memset
ftell
fseek
fopen
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ