DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
081b1a24ec30d7de0ed767ecabb003b3_JaffaCakes118.dll
Resource
win7-20240611-en
Target
081b1a24ec30d7de0ed767ecabb003b3_JaffaCakes118
Size
80KB
MD5
081b1a24ec30d7de0ed767ecabb003b3
SHA1
3c147727c82fdeeeb93177fcff6d1753785426ef
SHA256
b4d7aa1b5a6c4fe6da6e9f5515b252bfb5d4ed66102f03ff1cb12b02444aeeac
SHA512
8dec1b9256cde3aaf0add0b3b69e2f6a000391cedb0f2e9def91726df38e9786e40d2f5a027016c470de35a7810ef0d64138a536b0646ade645ef5e3ca1956da
SSDEEP
1536:nu1w9eipdSl9ZeweMum7Phk55h3esAoPGf:R9bpd0uGVoP
Checks for missing Authenticode signature.
resource |
---|
081b1a24ec30d7de0ed767ecabb003b3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
SetFileAttributesA
GetProcAddress
WideCharToMultiByte
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CreateProcessA
RemoveDirectoryA
CloseHandle
LocalFree
Sleep
WritePrivateProfileStringA
Process32Next
Process32First
MoveFileA
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
CreateThread
ExitProcess
GetCommandLineW
LoadLibraryA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DeleteFileA
DisableThreadLibraryCalls
GetCurrentProcessId
RegOpenKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strrchr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
_wcslwr
wcsstr
strchr
atoi
strlen
_access
sprintf
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
_strupr
memcpy
_purecall
memcmp
strstr
strcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ