DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
27d63e5bed88ef0b754e8384d0eaf6ce_JaffaCakes118.dll
Resource
win7-20240705-en
Target
27d63e5bed88ef0b754e8384d0eaf6ce_JaffaCakes118
Size
52KB
MD5
27d63e5bed88ef0b754e8384d0eaf6ce
SHA1
cb68cac389bc732254f4a87df6fd0886e0ab80aa
SHA256
31664cfd4869e92c5a3a4404d3327af7dc7abf7a638dc2923c32d8fb9aa28896
SHA512
f8b640554be5e76fec7ac3b17214082c066f37f10ffa38e0260de97ed3bc8d81d9bc70e64b17b101bee4274d6273144438b4b8a131831494d12902de397c0168
SSDEEP
768:GNcZKWA0AKLqzJSJOIfZn5RVs9/PG3Yng8Ai4MYrh9aPKg6wAAD6/tMh77Kf:VojlSJdjw91neioaPR5Eg77E
Checks for missing Authenticode signature.
resource |
---|
27d63e5bed88ef0b754e8384d0eaf6ce_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
Process32Next
Process32First
ExitProcess
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
GetSystemDirectoryA
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
MoveFileA
SetFileAttributesA
CreateDirectoryA
GetCommandLineW
GetModuleFileNameA
CreateProcessA
CloseHandle
LocalFree
Sleep
GetCurrentProcessId
lstrlenA
MultiByteToWideChar
CreateThread
LoadLibraryA
FreeLibrary
lstrlenW
WideCharToMultiByte
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
DeleteFileA
EnterCriticalSection
OpenSCManagerA
RegQueryValueExA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
strcpy
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_access
_wcslwr
wcsstr
strcmp
atoi
strcat
fopen
fseek
ftell
??3@YAXPAX@Z
strstr
strrchr
sprintf
strlen
strncpy
strchr
memset
strncmp
_strupr
memcmp
memcpy
??2@YAPAXI@Z
_purecall
fclose
fread
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ