DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
260b8a66b9444c88297f9ee429831832_JaffaCakes118.dll
Resource
win7-20240508-en
Target
260b8a66b9444c88297f9ee429831832_JaffaCakes118
Size
52KB
MD5
260b8a66b9444c88297f9ee429831832
SHA1
15dc18d212c3f3eeaef24faa1e75a1c63361da51
SHA256
0f0bca86033e8274edf177a36dfd3e61c1274080e983c43ed71e5e93732107f9
SHA512
9f788775e2ab71e55c6e825caeb54ebfbce8a3ba67c4a4d393be9d9420794bb4729186bb250e7188acaed57f65d93a5b602c203e810ef12a24cc4b03a4bd5cc5
SSDEEP
1536:sUoZEmJHQc3Xgd07GGOq2sbpGLUgmbTjMK+:oEmhwnrstKsj
Checks for missing Authenticode signature.
resource |
---|
260b8a66b9444c88297f9ee429831832_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
CreateDirectoryA
FreeLibrary
WideCharToMultiByte
CloseHandle
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
MultiByteToWideChar
LocalFree
Sleep
CreateThread
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
MoveFileA
GetCommandLineW
WritePrivateProfileStringA
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
LoadLibraryA
ExitProcess
GetProcAddress
GetCurrentProcessId
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strcmp
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
atoi
strncmp
strchr
strncpy
??3@YAXPAX@Z
strstr
memset
strrchr
sprintf
strcat
memcpy
_purecall
??2@YAPAXI@Z
memcmp
_stricmp
_access
strcpy
strlen
wcsstr
_wcslwr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ