DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1a2152420a61da041abb2a44f40dd8e0_JaffaCakes118.dll
Resource
win7-20240419-en
Target
1a2152420a61da041abb2a44f40dd8e0_JaffaCakes118
Size
52KB
MD5
1a2152420a61da041abb2a44f40dd8e0
SHA1
6a0498182b1746025b25297802a455e72efafa9a
SHA256
8c6979acee99ef27feb4a358951ff0647accba744f38a1284558a57633036a6a
SHA512
3ffc44534bfdcb3f860d8902d03a7701e6f98af3020b47aae21cd35b046b23a0f35f972aa31f84dd72ce65515d73345d7a05aac3fad446aa4a01f5e500720bb9
SSDEEP
1536:In/xdyunUBvvMjcnuWirf9UsRmM/w+0OV67x03w:qW8fVp/w667x
Checks for missing Authenticode signature.
resource |
---|
1a2152420a61da041abb2a44f40dd8e0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
lstrlenA
RemoveDirectoryA
GetCommandLineW
Process32Next
Process32First
WritePrivateProfileStringA
CreateDirectoryA
ExitProcess
CreateProcessA
EnterCriticalSection
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CloseHandle
GetModuleFileNameA
LocalFree
GetProcAddress
LoadLibraryA
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
lstrlenW
WideCharToMultiByte
Sleep
CreateThread
LeaveCriticalSection
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
wcsstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcmp
_purecall
memcpy
memcmp
sprintf
??3@YAXPAX@Z
strstr
strlen
strrchr
memset
strcat
strcpy
_access
??2@YAPAXI@Z
_strupr
_wcslwr
atoi
strchr
strncpy
strncmp
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ