DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
228908166cd0a6e83e4a461f24a1e273_JaffaCakes118.dll
Resource
win7-20240220-en
Target
228908166cd0a6e83e4a461f24a1e273_JaffaCakes118
Size
52KB
MD5
228908166cd0a6e83e4a461f24a1e273
SHA1
b52a0db3ebb6490310905debbc2e7ab0b75d7c47
SHA256
597e5f0b0d9f2db3ca46728521ba57b417e2993365f49fa9158a7e06c4b31569
SHA512
5ba3c422359266b146c66e41437cfad511a15c5a11fc08653fb73014b300aef38c81d1037ced7cf7ce4c9a090529e2cfba2064b57f89a82e2e54e7325d1c2a5d
SSDEEP
1536:K2cBpin3BEDUPOr9WUs33/y39QX+y31nV3hUljUvvAF:/CJcTn1nVujUvvA
Checks for missing Authenticode signature.
resource |
---|
228908166cd0a6e83e4a461f24a1e273_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LeaveCriticalSection
EnterCriticalSection
ExitProcess
Process32Next
Process32First
CreateDirectoryA
WritePrivateProfileStringA
WideCharToMultiByte
lstrlenW
Sleep
LocalFree
GetProcAddress
CreateThread
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCommandLineW
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
GetSystemDirectoryA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
DeleteFileA
RemoveDirectoryA
CreateProcessA
lstrlenA
MultiByteToWideChar
GetModuleFileNameA
LoadLibraryA
GetCurrentProcessId
FreeLibrary
MoveFileA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
strlen
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
strncmp
strncpy
memcpy
strchr
atoi
_wcslwr
wcsstr
memcmp
strcmp
strrchr
??3@YAXPAX@Z
strcat
strcpy
memset
_access
sprintf
strstr
??2@YAPAXI@Z
_strlwr
fclose
fread
ftell
fseek
fopen
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ