DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1667f039a829e83268d72fe5d91370bf_JaffaCakes118.dll
Resource
win7-20240611-en
Target
1667f039a829e83268d72fe5d91370bf_JaffaCakes118
Size
60KB
MD5
1667f039a829e83268d72fe5d91370bf
SHA1
c1c844913e8876438fe9a55651b4142ced3514c6
SHA256
17c9e900a47eb55ff44ddf48b59dced0a6cb658826f889181de98672e42daef8
SHA512
cc88b50d1e4522d96a3be286d2f431aeb09acee18da7f030e34763ccd5824a201311c1a21f186780624d8837eeb411aabaf232b42203d72710c6545dd278a660
SSDEEP
768:twgOGHWzEJq0Br8EA+tqMBb4m0GiWhY70GjQ6Gj5NEbZ9D6V042Y4DiDb4enevOi:twNTWBr8E/hBb4mrGjTP7MSW4enwFvm
Checks for missing Authenticode signature.
resource |
---|
1667f039a829e83268d72fe5d91370bf_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCommandLineW
Sleep
MultiByteToWideChar
lstrlenA
CreateThread
Process32Next
Process32First
WritePrivateProfileStringA
CreateDirectoryA
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
GetProcAddress
LoadLibraryA
FreeLibrary
LocalFree
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
GetSystemDirectoryA
CreateProcessA
CloseHandle
DeleteFileA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
MoveFileA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcat
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strchr
atoi
_purecall
_wcslwr
wcsstr
_access
strcpy
strlen
??3@YAXPAX@Z
memset
sprintf
fclose
fread
??2@YAPAXI@Z
ftell
fseek
fopen
_strupr
strrchr
strstr
strcmp
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ