DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
222eea487755346c6db8f5e460436973_JaffaCakes118.dll
Resource
win7-20240611-en
Target
222eea487755346c6db8f5e460436973_JaffaCakes118
Size
52KB
MD5
222eea487755346c6db8f5e460436973
SHA1
cd92395335d4c822a8a11924b01597a9c43e3310
SHA256
eee5ddc67f39e6bf798fb2d4b9dea31c02c3bccca9f7a766a08ec93deee39997
SHA512
8b17878bb43a20f0c073eb751c707131663541f27537239fb8c12d2f9669f69cd6799787ae0051cdf5bc404132c03d4612a1b45f8d16f25f587e54f55d5039c6
SSDEEP
1536:u/yeyH6NI8/6gYcME6G3kvBWYsSPteQ7pyA+c1+:tPwSI3kZW0PX+U
Checks for missing Authenticode signature.
resource |
---|
222eea487755346c6db8f5e460436973_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FreeLibrary
GetCurrentProcessId
Sleep
ExitProcess
CreateDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
RemoveDirectoryA
lstrlenA
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
GetCommandLineW
MoveFileA
GetExitCodeProcess
WaitForSingleObject
Process32First
Process32Next
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
lstrlenW
WideCharToMultiByte
SetFileAttributesA
LocalFree
CreateThread
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
CreateProcessA
GetModuleFileNameA
CloseHandle
MultiByteToWideChar
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
fclose
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
_wcslwr
wcsstr
memcmp
_purecall
memcpy
strncmp
strchr
strncpy
memset
strlen
sprintf
??3@YAXPAX@Z
strcmp
strrchr
strstr
strcat
strcpy
_access
_stricmp
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ