DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
021bfba06ca3447bf2043cb44bf000d5_JaffaCakes118.dll
Resource
win7-20231129-en
Target
021bfba06ca3447bf2043cb44bf000d5_JaffaCakes118
Size
56KB
MD5
021bfba06ca3447bf2043cb44bf000d5
SHA1
f33c0fccc05dd51d3d7b267bd041f961d873610f
SHA256
57d89b4478900bfcc928bd27704beb8b0322a0019ca0b3df36b3ac4c2a701d7e
SHA512
83386ee9d88b38844740747add2ef6ac11fb4c472796826b5c382aefff04bf488e8e06e8e9f5a157445954f342a735321afbd09c63ac543621dc1ab9cfab8f79
SSDEEP
1536:GL2q4WT7wBNsBPIGTgqH95K7IZVl3SWxr:GB4WTsBNsV3TZKCVl3SWx
Checks for missing Authenticode signature.
| resource |
|---|
| 021bfba06ca3447bf2043cb44bf000d5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
lstrlenA
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
ExitProcess
LocalFree
Sleep
DeleteCriticalSection
WideCharToMultiByte
GetExitCodeProcess
WaitForSingleObject
Process32Next
Process32First
CreateDirectoryA
GetCurrentProcessId
InitializeCriticalSection
DisableThreadLibraryCalls
CreateThread
MultiByteToWideChar
SetFileAttributesA
MoveFileA
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
CreateProcessA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetCommandLineW
FreeLibrary
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
??2@YAPAXI@Z
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_access
atoi
strcmp
strncmp
strchr
strncpy
_wcslwr
wcsstr
memcmp
strstr
strrchr
sprintf
strcat
strcpy
memset
??3@YAXPAX@Z
strlen
fclose
fread
_strupr
ftell
fseek
fopen
memcpy
_purecall
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ