DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
312b981f47871116b7aedb763cf3a01c_JaffaCakes118.dll
Resource
win7-20240704-en
Target
312b981f47871116b7aedb763cf3a01c_JaffaCakes118
Size
52KB
MD5
312b981f47871116b7aedb763cf3a01c
SHA1
1c66b6c3f804914db4f6799911924a216c54076a
SHA256
2f88fd8d9840c97a02c9f8a14bab626ee2414d8ff5e1588985c7746f423ef390
SHA512
a85f49969992656bc87ceb74ddf1908d858a8218491c89e5a4e8394378fe3592e78d2dd8be565cee40f9091507264c03f8505f39dde005b9ed3b12aad9ffe6ff
SSDEEP
1536:OreDWy+mJ0ex3/L64WWf+X+NeHDKOnsdAnFb8sir:AyN0et64hNIKYFb8si
Checks for missing Authenticode signature.
resource |
---|
312b981f47871116b7aedb763cf3a01c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedDecrement
HeapDestroy
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
Sleep
GetCurrentProcessId
WritePrivateProfileStringA
CreateThread
FindNextFileA
InterlockedIncrement
FindFirstFileA
ExitProcess
LocalFree
SetFileAttributesA
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
MoveFileA
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
GetCommandLineW
GetProcAddress
LoadLibraryA
FreeLibrary
CloseHandle
CreateDirectoryA
EnterCriticalSection
LeaveCriticalSection
DeleteFileA
CreateProcessA
RemoveDirectoryA
GetPrivateProfileStringA
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
??2@YAPAXI@Z
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
strcmp
_wcslwr
strcat
strcpy
memset
_access
sprintf
strstr
??3@YAXPAX@Z
strlen
memcpy
_purecall
_strupr
memcmp
strrchr
atoi
strchr
wcsstr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ