DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1c597c84cfbc18e3e4f854d1e4e83d85_JaffaCakes118.dll
Resource
win7-20240220-en
Target
1c597c84cfbc18e3e4f854d1e4e83d85_JaffaCakes118
Size
52KB
MD5
1c597c84cfbc18e3e4f854d1e4e83d85
SHA1
6542c54d0632cf2385cb359de6b38488dacce8e3
SHA256
c820c2b787b446fa06d607f4059970a10cbd2d217c5a70dec3aaef26d7707190
SHA512
0eecee33f87710d9d1183ea4937b986f2c061a0a57404820325e4d7284cb37536cd26b3abbc3f3fb07e660a4d2a3f277ff855a7a5866139ed070385522c2e306
SSDEEP
1536:GDu+ncEDimCJvsfm1M2QGeiw4nE7/XyLe0:GSM6JvfTHeiw7ya
Checks for missing Authenticode signature.
resource |
---|
1c597c84cfbc18e3e4f854d1e4e83d85_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
CreateDirectoryA
Process32Next
Process32First
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
SetFileAttributesA
HeapDestroy
GetShortPathNameA
GetModuleHandleA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
RemoveDirectoryA
CreateThread
ExitProcess
GetExitCodeProcess
WaitForSingleObject
GetCommandLineW
DeleteFileA
MoveFileA
LocalFree
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
Sleep
CloseHandle
InterlockedDecrement
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcmp
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_purecall
memcpy
fopen
fseek
ftell
??2@YAPAXI@Z
fread
??3@YAXPAX@Z
memset
sprintf
atoi
strchr
memcmp
strlen
strncpy
strncmp
strcpy
_strupr
strrchr
_access
strcat
strstr
fclose
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ