DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
094f0bc527d6e9ae3840dc4e81ccc019_JaffaCakes118.dll
Resource
win7-20240221-en
Target
094f0bc527d6e9ae3840dc4e81ccc019_JaffaCakes118
Size
52KB
MD5
094f0bc527d6e9ae3840dc4e81ccc019
SHA1
5d917d2d80383c85ca94d90dfa044cff30f4ca9f
SHA256
0615cfc7c1d49c19c1f945a85769beb0e21281bf56ccc60539cde3f0638cde53
SHA512
6b184c97270ab898a79f05b2e21653c299c663ddbfbaf8060f9d65acaed13488101c3dccfab472ad5b30a84a575f86473e260f52fb560218f2fdbd907e13204d
SSDEEP
768:/desTOnMTDcpjRS7LEo0UnLok30Fcj5GS0f0MLVKAdnZJjUBqxqGOPbp0g9Ti:V5Trc+7LEwn8eAcVaskdfhhOPWg9e
Checks for missing Authenticode signature.
resource |
---|
094f0bc527d6e9ae3840dc4e81ccc019_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
WideCharToMultiByte
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
FreeLibrary
LoadLibraryA
LocalFree
GetProcAddress
RemoveDirectoryA
lstrlenW
Process32Next
Process32First
CreateThread
WritePrivateProfileStringA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCommandLineW
ExitProcess
CreateDirectoryA
GetSystemDirectoryA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
Sleep
GetCurrentProcessId
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
GetModuleFileNameA
MoveFileA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
atoi
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_purecall
strcmp
??2@YAPAXI@Z
strrchr
memset
strlen
sprintf
wcsstr
_wcslwr
??3@YAXPAX@Z
strncpy
strchr
strncmp
strcpy
_strupr
_access
strcat
strstr
memcmp
memcpy
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ