DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
189c5a5c3f6c19a33372e6001c0707f4_JaffaCakes118.dll
Resource
win7-20240220-en
Target
189c5a5c3f6c19a33372e6001c0707f4_JaffaCakes118
Size
48KB
MD5
189c5a5c3f6c19a33372e6001c0707f4
SHA1
87fd07d0d7aa7d8c5460953a515687f0ad342d28
SHA256
5d706b30ce2fb52c20e15f34806805efd03922c4a14fc26f17eef2f6ea0f833c
SHA512
343dbdb4dd3ae87f05c912190dac6e356f3276ec59462e559bb10a64f2eb470df3319fd73e3a6918cf88020edc7cf3fd1aa55fc6f06f4fa93ff18a7deeae7438
SSDEEP
768:KBpYvYLJPZtT6JLI7ASeBChpcDHa4ynDNt8MfUuQEmFzllTgNi8jbtpKIEe:8p2YLtjJ7veohgHiNaMfHIzz4iWtp
Checks for missing Authenticode signature.
resource |
---|
189c5a5c3f6c19a33372e6001c0707f4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapDestroy
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
GetCommandLineW
CreateThread
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetCurrentProcessId
InterlockedDecrement
FreeLibrary
WritePrivateProfileStringA
Sleep
LocalFree
ExitProcess
Process32Next
Process32First
CreateDirectoryA
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
MultiByteToWideChar
SetFileAttributesA
MoveFileA
lstrlenW
WideCharToMultiByte
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
DeleteFileA
RemoveDirectoryA
BuildExplicitAccessWithNameA
RegEnumKeyExA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memcmp
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
strcmp
fopen
fseek
ftell
fread
fclose
strncmp
strchr
strstr
strrchr
sprintf
strlen
??3@YAXPAX@Z
wcsstr
_wcslwr
memcpy
_purecall
??2@YAPAXI@Z
_strupr
memset
strcat
strcpy
_access
strncpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ