DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
066ca04163943b4983001668b87be2cc_JaffaCakes118.dll
Resource
win7-20240221-en
Target
066ca04163943b4983001668b87be2cc_JaffaCakes118
Size
64KB
MD5
066ca04163943b4983001668b87be2cc
SHA1
0bf3f767e8b56674416d16ba50601ddf855aaa86
SHA256
ed55eaaadee8c60d91a1de41876995c1372c4dc82f7f60a4cc3941afdfb41804
SHA512
b2a95feb642bed7150f590f9393063f9d94066a40ce54bf30325f8cd91a61027e9baaddf29d14b3129ea9039127a8c1028b51f63eced1cce129c0699f64e6a03
SSDEEP
768:G9hTsvoQcHSd3odejB3F7a/ctwXjGZfPJ6esnpj87caXZjnqNBMkKbUtyDRvacKf:GTBAYMBpZtFfPIn25kqUsloYLS
Checks for missing Authenticode signature.
resource |
---|
066ca04163943b4983001668b87be2cc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
WritePrivateProfileStringA
LocalFree
CloseHandle
Process32Next
Process32First
SetFileAttributesA
CreateThread
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
ExitProcess
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
FreeLibrary
GetModuleFileNameA
GetCommandLineW
LoadLibraryA
GetProcAddress
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
CreateProcessA
LeaveCriticalSection
EnterCriticalSection
MoveFileA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
_wcslwr
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
_purecall
atoi
memcpy
strncmp
strchr
strncpy
strstr
fopen
fseek
??3@YAXPAX@Z
strcat
strcpy
memset
_access
sprintf
strcmp
strrchr
memcmp
wcsstr
_stricmp
strlen
fclose
fread
??2@YAPAXI@Z
ftell
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ