DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
30254eead79f2302c2670b80b9eef9b5_JaffaCakes118.dll
Resource
win7-20240704-en
Target
30254eead79f2302c2670b80b9eef9b5_JaffaCakes118
Size
64KB
MD5
30254eead79f2302c2670b80b9eef9b5
SHA1
c9f88c1631c40f00badd8adf6a045b32b0385a7b
SHA256
13e3f568f4e7850ef9d7cd8dacb3e3b89fb328ef28933ab0981131c6afaf29c9
SHA512
42d0eb1e35a052f0ed87b550b8c59b27dd573b50d1ba93b8c87088c4ee11fffac582f9f19270bd8163c8b585c9014a7df964fe2d5feafb142acae392c357b94a
SSDEEP
1536:4BzigsUbzMUeKg3y37B+UdURkAikt4BcHsRYU/tFUDcIdL/fDui:ynn4e7BgRGBRv/tYxdL/f6i
Checks for missing Authenticode signature.
resource |
---|
30254eead79f2302c2670b80b9eef9b5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
RemoveDirectoryA
MoveFileA
CreateDirectoryA
LocalFree
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
GetCurrentProcessId
GetProcAddress
CreateThread
CreateProcessA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
LoadLibraryA
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
Sleep
MultiByteToWideChar
lstrlenA
SetFileAttributesA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
strlen
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
_purecall
_wcslwr
wcsstr
_access
strcpy
strcat
??3@YAXPAX@Z
sprintf
strstr
??2@YAPAXI@Z
atoi
strchr
strrchr
memcmp
memcpy
memset
_stricmp
fclose
fread
ftell
fseek
fopen
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ