DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0fed65a255f3ad67658a11e68bba72f3_JaffaCakes118.dll
Resource
win7-20231129-en
Target
0fed65a255f3ad67658a11e68bba72f3_JaffaCakes118
Size
72KB
MD5
0fed65a255f3ad67658a11e68bba72f3
SHA1
bb1c851065dd3cc3b2f673c231f0f2059d81b02b
SHA256
94181ec4ce8a921b34c5d6190253444066b9e892bd5ce40b8dc3aa57630b076b
SHA512
2fcb7d19c49110e56d2c419a0c73ce41ab6b911a742622c6a9439699a2920e653388acf06d5f34cc480e7c654acc923d54d26fdaabb12ab8631e80dad68d0513
SSDEEP
1536:HHsprM0cmSOntzTErKi8cK7aTYe1cfVctznDXzOd:no42EK6AMznDzOd
Checks for missing Authenticode signature.
resource |
---|
0fed65a255f3ad67658a11e68bba72f3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
FreeLibrary
LoadLibraryA
GetProcAddress
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
FindNextFileA
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
WritePrivateProfileStringA
RemoveDirectoryA
MoveFileA
CreateThread
lstrlenA
MultiByteToWideChar
Sleep
lstrlenW
WideCharToMultiByte
GetCurrentProcessId
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
CreateDirectoryA
DeleteFileA
SetFileAttributesA
ExitProcess
LocalFree
EnterCriticalSection
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
sprintf
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strcpy
_purecall
memcpy
memcmp
_wcslwr
wcsstr
strcmp
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
strrchr
_strlwr
strstr
atoi
strchr
_access
strlen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ