DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
16b4ab842b5353db6bbcf99943e5fbbe_JaffaCakes118.dll
Resource
win7-20240611-en
Target
16b4ab842b5353db6bbcf99943e5fbbe_JaffaCakes118
Size
72KB
MD5
16b4ab842b5353db6bbcf99943e5fbbe
SHA1
91f80ed84506c39da1b433364ad9d827caf1a4cb
SHA256
85a85ebc9ca31c3f429d6369971453f1f0ef3e0488be0ddd5441f60b8ebc30e4
SHA512
d668631913f5493a57a8051bffe982d7d1551ae2a809a7e14288a5f1aba20a440e09e43bc4e6a59f7f11fe39453badb0ed9b2fc1cdbc2e09c806578b6cea677d
SSDEEP
1536:oyPkg8Cvi1AvbDh4nC3nyB+L4iWi1KcrON:dPZi1+DS+UidKcrm
Checks for missing Authenticode signature.
resource |
---|
16b4ab842b5353db6bbcf99943e5fbbe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
Sleep
FreeLibrary
GetCommandLineW
CreateProcessA
RemoveDirectoryA
DeleteFileA
ExitProcess
WritePrivateProfileStringA
LocalFree
FindNextFileA
SetFileAttributesA
FindFirstFileA
CloseHandle
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
CreateThread
MoveFileA
GetCurrentProcessId
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
DisableThreadLibraryCalls
GetPrivateProfileStringA
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
GetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memset
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strrchr
strcmp
atoi
_wcslwr
_access
strcat
sprintf
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
strncpy
strchr
_stricmp
strncmp
strlen
strcpy
strstr
wcsstr
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ