DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
157674fb176c952bb16d57df9d33aeb7_JaffaCakes118.dll
Resource
win7-20240221-en
Target
157674fb176c952bb16d57df9d33aeb7_JaffaCakes118
Size
72KB
MD5
157674fb176c952bb16d57df9d33aeb7
SHA1
a996d4b9ba77ea48ad7ba3db35549ec39afc634c
SHA256
7805caacaa3f86021d0f6b60da4cfbfa88def75ee0d4c070d44707e17afce5a6
SHA512
3e3a642f4938125b0c75cad3d9b8e89a69c34b98486fc72c2ecf72be912b53e094b47cae011176e7b8e955e640b935e00685d289f31195340cab5946b5ee7036
SSDEEP
768:sSC0phLWmQU+pRiMT4tE9WBbDWnvZ1qEtONse2yAUtIIHR3mjLGm2lu61WKnb:sl0phT8pRhcFWv2Bk3NIHx4Kpltnb
Checks for missing Authenticode signature.
resource |
---|
157674fb176c952bb16d57df9d33aeb7_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenW
GetModuleFileNameA
CreateThread
CloseHandle
Process32Next
Process32First
Sleep
CreateProcessA
GetSystemDirectoryA
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
LeaveCriticalSection
WideCharToMultiByte
RemoveDirectoryA
CreateDirectoryA
ExitProcess
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
LocalFree
MultiByteToWideChar
MoveFileA
GetCommandLineW
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
EnterCriticalSection
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strchr
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strcmp
_wcslwr
wcsstr
_purecall
_access
memcpy
strncmp
strncpy
strcpy
strstr
memset
strrchr
sprintf
strcat
??3@YAXPAX@Z
??2@YAPAXI@Z
strlen
memcmp
atoi
_stricmp
fclose
fread
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ