DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
36a3b9d290acfbf0161aedd941bf43d8_JaffaCakes118.dll
Resource
win7-20240704-en
Target
36a3b9d290acfbf0161aedd941bf43d8_JaffaCakes118
Size
52KB
MD5
36a3b9d290acfbf0161aedd941bf43d8
SHA1
3b138d527daaa87804558d440cd2a102d0cc8ba0
SHA256
1d2e5618f5c645869a2fb231fced41044c817f1d0b572f0e789e6fae65ecf175
SHA512
1aa927aba7c91abf5b0216f817510d576836e12ea6e7302a6aecc58c9a4f1d505c9f54b6da39910c88a8bd00a8ec316f471a0f5a32ebbcd3c5278c950d3ae3e5
SSDEEP
768:G/suiunTFTyAVd1Fac3h1vsDZNDSxLgA4+0O1Ychzu80+CKLB174hDOtNqgphT:G/BJT31/R1WTHAdCclB0wB174hSv5ph
Checks for missing Authenticode signature.
resource |
---|
36a3b9d290acfbf0161aedd941bf43d8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
WritePrivateProfileStringA
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
CreateDirectoryA
SetFileAttributesA
ExitProcess
Sleep
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
MoveFileA
CreateThread
DeleteFileA
GetCommandLineW
FreeLibrary
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
LocalFree
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
DisableThreadLibraryCalls
ControlService
DeleteService
CloseServiceHandle
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
OpenSCManagerA
OpenServiceA
CommandLineToArgvW
SHGetSpecialFolderPathA
SHChangeNotify
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
fclose
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strcpy
_purecall
strchr
atoi
_access
_wcslwr
wcsstr
strcat
sprintf
memcmp
memcpy
??3@YAXPAX@Z
memset
strlen
strstr
strcmp
strrchr
_stricmp
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ