DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
199fe048e6e0eee6ed1e53ddb403b12d_JaffaCakes118.dll
Resource
win7-20240508-en
Target
199fe048e6e0eee6ed1e53ddb403b12d_JaffaCakes118
Size
64KB
MD5
199fe048e6e0eee6ed1e53ddb403b12d
SHA1
e079532f7c9df12075fb14ba123a1ab78b7f5f92
SHA256
c90ae8cb59df7586e06854d473390bfda46afacda204682574ca1452bf144b83
SHA512
83d87a13dd3c5ea15146f178b02b6df7a85d8e2c5400d3aebc96c11608d17ad73349352f088953ea2c0bf88db292580d505a38b467b4b58975de2d838ef20b4e
SSDEEP
1536:AnkKvsQd3rz8ahMSUpAKPw22cDrkr/9tVu4ObFbUQW:mtxPGw22ck/dus
Checks for missing Authenticode signature.
resource |
---|
199fe048e6e0eee6ed1e53ddb403b12d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetExitCodeProcess
WaitForSingleObject
GetCommandLineW
LocalFree
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
WritePrivateProfileStringA
Process32Next
Process32First
GetSystemDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Sleep
CreateDirectoryA
CreateThread
MoveFileA
CloseHandle
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteFileA
CreateProcessA
RemoveDirectoryA
GetCurrentProcessId
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
fread
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strchr
atoi
strcmp
_purecall
memcpy
_wcslwr
wcsstr
??3@YAXPAX@Z
strcat
strcpy
memset
sprintf
_access
memcmp
strstr
strlen
fclose
_strlwr
??2@YAPAXI@Z
ftell
fseek
fopen
strrchr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ