DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0d31082453b8f8fbed150e04a0bedb21_JaffaCakes118.dll
Resource
win7-20240508-en
Target
0d31082453b8f8fbed150e04a0bedb21_JaffaCakes118
Size
52KB
MD5
0d31082453b8f8fbed150e04a0bedb21
SHA1
ba5b7a6a282e8fccbda9bf8632d79a67587ba9ad
SHA256
448f7255a9600a0ca4a8f3becffa8c4bf63a3913d9413c24f8e35aa1e8e97118
SHA512
e31923af7214a462fdfbe45f10b5038f1b255e3320f4950df08d5b521fd399e0217f7f9644fa65156060f44f377df09d6a18d328122a299a881efbd7d8ff194e
SSDEEP
1536:6wnPZhM2dXwSosUmxQ6T+AU5U7WkOd3Txsvwvzzq9+:LnPxwfsJTmMwvz20
Checks for missing Authenticode signature.
resource |
---|
0d31082453b8f8fbed150e04a0bedb21_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
LoadLibraryA
FreeLibrary
WideCharToMultiByte
LocalFree
Process32Next
Process32First
WritePrivateProfileStringA
RemoveDirectoryA
Sleep
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
MoveFileA
ExitProcess
CreateDirectoryA
GetCommandLineW
CreateThread
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
CreateProcessA
DeleteFileA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
strcpy
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcmp
_wcslwr
wcsstr
strrchr
strstr
sprintf
??3@YAXPAX@Z
memset
memcpy
_purecall
??2@YAPAXI@Z
memcmp
strlen
strcat
_strupr
strncpy
strchr
strncmp
atoi
_access
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ