DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0ef88cf51a79b947a8b20c0d05b5cee9_JaffaCakes118.dll
Resource
win7-20240508-en
Target
0ef88cf51a79b947a8b20c0d05b5cee9_JaffaCakes118
Size
60KB
MD5
0ef88cf51a79b947a8b20c0d05b5cee9
SHA1
70448e71ab9667a4ad5c11295f80268d49bef0ed
SHA256
44a4e41397f350a29da7fdc8fc64b6285a9f7b8d76b9ed98e14c2d54bdb2b489
SHA512
24d15b3a46df5e02081eb8b8ad7be0366fde0d42abfac6d772653ee542db899565a3e774aa858ee6e1ec1a24b765eac3e202f4ec36a1d30c8b184c0938f9455d
SSDEEP
1536:DgFvI2SJBc1VHQNbODAVUCRpNEFX7X5fCYDOJ3:0FwbOVHItzAX5Du3
Checks for missing Authenticode signature.
resource |
---|
0ef88cf51a79b947a8b20c0d05b5cee9_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateProcessA
GetSystemDirectoryA
Process32Next
Process32First
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
WritePrivateProfileStringA
Sleep
RemoveDirectoryA
MoveFileA
SetFileAttributesA
CreateDirectoryA
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CloseHandle
GetExitCodeProcess
GetProcAddress
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
ExitProcess
GetCommandLineW
LoadLibraryA
FreeLibrary
CreateThread
GetCurrentProcessId
DeleteFileA
LocalFree
SetNamedSecurityInfoA
SetEntriesInAclA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strrchr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
atoi
_purecall
strcmp
_access
strlen
strncmp
strchr
??3@YAXPAX@Z
sprintf
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
_strupr
memcmp
memcpy
strstr
strcpy
strncpy
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ