DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1817e65a05af3d0c70fcd2d4f1ccdd83_JaffaCakes118.dll
Resource
win7-20240508-en
Target
1817e65a05af3d0c70fcd2d4f1ccdd83_JaffaCakes118
Size
52KB
MD5
1817e65a05af3d0c70fcd2d4f1ccdd83
SHA1
a2ba0d24dab50dffce525f197384439b9931329b
SHA256
12c9f06193c45b04c35942dcc8e93cf2cbfab654daeed492987fb3c2810b3ae3
SHA512
c5356ab27b0cb635e223176d4535055f3851fea47a92a3b16db8b73a231214441cd6c3e40ba3314b75e61f69318b9e27b05a396e89c707d26c083b1671ccf915
SSDEEP
1536:G+NjKrv6UsbJiJWGqUbvCHgKNGFZLH6B:rW6dJ+WWa8jLH
Checks for missing Authenticode signature.
resource |
---|
1817e65a05af3d0c70fcd2d4f1ccdd83_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindFirstFileA
MoveFileA
SetFileAttributesA
MultiByteToWideChar
CreateThread
lstrlenA
WritePrivateProfileStringA
Process32Next
Process32First
GetCurrentProcessId
ExitProcess
GetPrivateProfileStringA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCommandLineW
CreateDirectoryA
DeleteFileA
FindNextFileA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
Sleep
GetProcAddress
LocalFree
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryA
RemoveDirectoryA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
atoi
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
??2@YAPAXI@Z
_purecall
_access
strcat
sprintf
strstr
strlen
??3@YAXPAX@Z
memset
strrchr
strncpy
strchr
strncmp
strcpy
_strupr
wcsstr
_wcslwr
memcmp
memcpy
strcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ