DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1b3f09223af8f281c88f5fbc914f836f_JaffaCakes118.dll
Resource
win7-20240611-en
Target
1b3f09223af8f281c88f5fbc914f836f_JaffaCakes118
Size
60KB
MD5
1b3f09223af8f281c88f5fbc914f836f
SHA1
d33fedfa72a927d33e4428aa392f1c8bf9c82aa6
SHA256
c2bd5f726fb87090f86c7420e157bb786c0222e111cddb07f328fce6df290a7a
SHA512
e62969663b58a93d49c1b546295b81dd3b91aac373e38c656211d66001051ccddfb716dc47abf793a12993c9c2935128dac4b9ccde53d2ee530c215d88d31eab
SSDEEP
768:hSp1q+jcouLZmIGSJ6LhSNX26qEcVBkyLPnUpii4EHqOwzkpQczjBFk3QJY82Laz:hSvI4PByAtH/Si2HScnBF+1LaL++
Checks for missing Authenticode signature.
resource |
---|
1b3f09223af8f281c88f5fbc914f836f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RemoveDirectoryA
DeleteFileA
GetSystemDirectoryA
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
CreateProcessA
GetExitCodeProcess
WaitForSingleObject
LocalFree
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
WritePrivateProfileStringA
MoveFileA
SetFileAttributesA
GetCurrentProcessId
Sleep
CreateDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
ExitProcess
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
CreateThread
Process32First
CloseHandle
Process32Next
GetModuleHandleA
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
GetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strncmp
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
atoi
strcmp
strrchr
fopen
fseek
ftell
fread
strcpy
??3@YAXPAX@Z
sprintf
memcmp
memcpy
_access
strcat
strncpy
strchr
memset
_strupr
strlen
strstr
_purecall
??2@YAPAXI@Z
fclose
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ