DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
2362b0d1a4c4ade2a31a6c244b73b09d_JaffaCakes118.dll
Resource
win7-20240508-en
Target
2362b0d1a4c4ade2a31a6c244b73b09d_JaffaCakes118
Size
68KB
MD5
2362b0d1a4c4ade2a31a6c244b73b09d
SHA1
f544f50ef2a7963b3d62db0e814bd2199da51a26
SHA256
1782daf9fafa3aef94fd2306865350ea04918c978226457291a218330a016ac6
SHA512
9b5ad90dd477d1abbbc0f526f8213eb13e58752e9b10396d4295e31c5d1fd8291015f7f5dd315de9c9536a1c9920d623ccf1ec20e82bbcd9e46e1bd83ee2bc6b
SSDEEP
1536:HeQAMtljCvlwo7d7/9Ok65A9RMfSmkwQ/wNYqqaDY:kYlCvz7ikSjqONYqqaD
Checks for missing Authenticode signature.
resource |
---|
2362b0d1a4c4ade2a31a6c244b73b09d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
WideCharToMultiByte
WritePrivateProfileStringA
Sleep
CreateThread
GetCommandLineW
CreateDirectoryA
MoveFileA
GetCurrentProcessId
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
SetFileAttributesA
LocalFree
Process32First
Process32Next
LoadLibraryA
GetProcAddress
ExitProcess
CloseHandle
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
DeleteFileA
FreeLibrary
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcmp
strncmp
strncpy
memcmp
sprintf
strstr
strrchr
wcsstr
_wcslwr
strlen
memset
strcat
strcpy
??3@YAXPAX@Z
_strupr
atoi
strchr
_access
memcpy
_purecall
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ