DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0daf21a5f8dc137beb72ef1378e55aba_JaffaCakes118.dll
Resource
win7-20240221-en
Target
0daf21a5f8dc137beb72ef1378e55aba_JaffaCakes118
Size
64KB
MD5
0daf21a5f8dc137beb72ef1378e55aba
SHA1
a24be9c3dde00d17f9e787da6dd05cf1f1eab785
SHA256
32289cc00d632be6c0c829a43eeb634fe433e2aac087fbe8a4d328c3a7eefb3c
SHA512
cb1c1e2bd8562e1a3df538ebd074460cf5434061e5d613246ab657073eaae70543f1c92c38aa69c00887010cd8c1b081b01145e34077f96b985b568b0a26a640
SSDEEP
768:grfHZ+jv61/9Wj7QMwytc0fQTMB+6rjkU0J2T7d/Tx9gPLepetrHRGJDhb13mgeR:EoDUC7wyad6UkRrxm6y7cbFmhZyw
Checks for missing Authenticode signature.
resource |
---|
0daf21a5f8dc137beb72ef1378e55aba_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
Sleep
LocalFree
GetCurrentProcessId
ExitProcess
CloseHandle
Process32Next
Process32First
InterlockedDecrement
RemoveDirectoryA
CreateThread
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
MoveFileA
SetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
CreateDirectoryA
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteFileA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
FreeLibrary
GetProcAddress
CreateProcessA
SetNamedSecurityInfoA
SetEntriesInAclA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcat
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
strstr
_access
_wcslwr
wcsstr
strcpy
strlen
strncmp
sprintf
memcmp
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
_strupr
strrchr
memcpy
_purecall
strncpy
strchr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ