DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0517945059e23bf048faf6e8f4f53e18_JaffaCakes118.dll
Resource
win7-20240611-en
Target
0517945059e23bf048faf6e8f4f53e18_JaffaCakes118
Size
52KB
MD5
0517945059e23bf048faf6e8f4f53e18
SHA1
c51c221f2ebf6234b682372420c00f2de0adb135
SHA256
c123d7c8e49131e96ed30c63bda19559b3c7e0faca36bb37625ed87925cbba33
SHA512
e9937701a50ec2463d8fa276197d2b600b6349676a4753826e7133906ec283aa52d740644849af46b02f70c692d383a22486488aa0585297bf836035a5d63de5
SSDEEP
1536:7EK8Rp/CJdbgbYy+iy6LsPi4zJQGYWGxvkL9D:7E3pKJgfTWGtk
Checks for missing Authenticode signature.
resource |
---|
0517945059e23bf048faf6e8f4f53e18_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
FreeLibrary
LocalFree
ExitProcess
GetSystemDirectoryA
GetCommandLineW
FindNextFileA
SetFileAttributesA
InterlockedIncrement
FindFirstFileA
MoveFileA
Sleep
Process32Next
Process32First
CreateThread
CreateDirectoryA
WritePrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteFileA
RemoveDirectoryA
CreateProcessA
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
CloseHandle
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
GetNamedSecurityInfoA
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
??2@YAPAXI@Z
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
??3@YAXPAX@Z
strlen
memset
strcat
strcpy
sprintf
memcmp
memcpy
_access
_purecall
_strupr
strstr
atoi
strchr
strcmp
strrchr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ