DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
18ab4048f97b4e624f76c2c3c42f9d98_JaffaCakes118.dll
Resource
win7-20240611-en
Target
18ab4048f97b4e624f76c2c3c42f9d98_JaffaCakes118
Size
64KB
MD5
18ab4048f97b4e624f76c2c3c42f9d98
SHA1
d700ea8b64b792413ab65b121877eb14fdce1545
SHA256
1947cb2658ce18f10282943b484a54665e4feb315fffd697af8c12bd9bdb952f
SHA512
c29e8e51f71739327b2f390bc2723e3a780c021ac2100b1a11060c8eed4dc8a0166991a41d2165cd2f1fb5b53f9e8b56fd1ed89907c1662095a3f19e8b5fc6bc
SSDEEP
1536:xveD03ZKh3V//OzrGG57oLrPFLGQL4W1f7:YIpKhIC1f7
Checks for missing Authenticode signature.
resource |
---|
18ab4048f97b4e624f76c2c3c42f9d98_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
CreateDirectoryA
WideCharToMultiByte
LocalFree
SetFileAttributesA
CreateThread
FindNextFileA
GetPrivateProfileStringA
MultiByteToWideChar
WritePrivateProfileStringA
GetExitCodeProcess
CloseHandle
WaitForSingleObject
GetSystemDirectoryA
Process32Next
Process32First
GetCommandLineW
ExitProcess
MoveFileA
lstrlenW
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
RemoveDirectoryA
CreateProcessA
LoadLibraryA
GetProcAddress
DeleteFileA
Sleep
FindFirstFileA
RegQueryValueExA
RegSetValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
sprintf
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strcmp
memcmp
_purecall
memcpy
atoi
_access
strstr
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
strrchr
_strupr
strncpy
strchr
strncmp
strlen
strcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ