DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
21d087d116f8a95345263ee6b9549720_JaffaCakes118.dll
Resource
win7-20240221-en
Target
21d087d116f8a95345263ee6b9549720_JaffaCakes118
Size
60KB
MD5
21d087d116f8a95345263ee6b9549720
SHA1
efdb49e46f442797b451054f6b6e9876811654d5
SHA256
deff28c74391f2614f69668027e971cd71e216072be2986a2548e29da98db991
SHA512
5ea599a909312a412575507cf74d43768e0095a8cc719b3e6aa69f985382ae218608fec5796806f4bfca39367ee4e3d7b3c2aa6475086e776c773512c82eda1d
SSDEEP
1536:/VzBLszb/F0wUCf3rEPwv11/Nih6jKaPFk:9zBqb/Fc27awf/Nk6jK0Fk
Checks for missing Authenticode signature.
resource |
---|
21d087d116f8a95345263ee6b9549720_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
lstrlenW
GetModuleFileNameA
GetExitCodeProcess
CloseHandle
WaitForSingleObject
GetSystemDirectoryA
WritePrivateProfileStringA
Sleep
CreateThread
MoveFileA
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
LocalFree
GetCurrentProcessId
lstrlenA
MultiByteToWideChar
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
LoadLibraryA
GetProcAddress
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
CreateProcessA
ExitProcess
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
memcmp
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
strchr
atoi
wcsstr
_wcslwr
??3@YAXPAX@Z
_access
strcat
strcpy
memset
sprintf
strstr
strrchr
_stricmp
strlen
strcmp
memcpy
_purecall
??2@YAPAXI@Z
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ