DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
2a49275f99ec27a5529682ef675eb2f6_JaffaCakes118.dll
Resource
win7-20240705-en
Target
2a49275f99ec27a5529682ef675eb2f6_JaffaCakes118
Size
56KB
MD5
2a49275f99ec27a5529682ef675eb2f6
SHA1
430bb5bc565239fb0b3e7f0d11d19d7b17d4487e
SHA256
c8efdef5e488dedcb2d244531f1442931f4ce4e0af7057a3d023636f2f275222
SHA512
dc497de539dc4e53600d1a5ab13331383bcc3bc82861eb2b5227b8bba48a3f7586a7a2cb32e67f8cfdd9e4196279227c0d51dfa20395b43db416e077588e1614
SSDEEP
1536:IcO9sv+rAmYLWhb+Ex8u/97U3mT7Ue1p:3kLr3QWhbXXUEUe1p
Checks for missing Authenticode signature.
resource |
---|
2a49275f99ec27a5529682ef675eb2f6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteFileA
GetCurrentProcessId
MoveFileA
SetFileAttributesA
CreateProcessA
WritePrivateProfileStringA
Sleep
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
GetSystemDirectoryA
CreateThread
GetExitCodeProcess
WaitForSingleObject
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
LocalFree
GetCommandLineW
GetProcAddress
Process32First
Process32Next
CloseHandle
LoadLibraryA
FreeLibrary
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
ExitProcess
lstrlenA
MultiByteToWideChar
InterlockedDecrement
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
_access
_purecall
strncmp
strncpy
strlen
strrchr
strcat
fopen
??3@YAXPAX@Z
strstr
memcmp
memcpy
wcsstr
_wcslwr
atoi
strchr
strcpy
sprintf
_strupr
memset
fclose
fread
ftell
fseek
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ