DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
33bdedcafe61e14f8eb65a784234ca59_JaffaCakes118.dll
Resource
win7-20240704-en
Target
33bdedcafe61e14f8eb65a784234ca59_JaffaCakes118
Size
68KB
MD5
33bdedcafe61e14f8eb65a784234ca59
SHA1
14da5ef6e916312329e0fc0dc5b3a297484d4595
SHA256
49b6ec83e660effec37a4baa6737e4b8827e15311dff3f22c933ad591dcdc315
SHA512
40fc6ad56f7056f58fd1f18dd6c99e5a003c37c5a863b79a9f3788c54c40d112c4b950d1cba4f672f84341128d0562c934957c420339e5f8acedfb430dfc361f
SSDEEP
768:kfd2e11zlAQiOt6KeAvuNW8nHZttfHLFBS67VWoQk08oggA2IRHqYjtjAFLfoM:811iQiOgKeIuNrV/7S6xSLAbVTtsdwM
Checks for missing Authenticode signature.
resource |
---|
33bdedcafe61e14f8eb65a784234ca59_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
WritePrivateProfileStringA
ExitProcess
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetProcAddress
lstrlenA
GetShortPathNameA
GetModuleHandleA
WideCharToMultiByte
CreateThread
GetExitCodeProcess
WaitForSingleObject
CreateDirectoryA
Process32Next
Process32First
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
Sleep
RemoveDirectoryA
CreateProcessA
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
LocalFree
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
LoadLibraryA
lstrlenW
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
BuildExplicitAccessWithNameA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize
SysFreeString
LoadRegTypeLi
SysStringLen
VariantClear
SysAllocString
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
strcpy
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
memcmp
_purecall
memcpy
fopen
fseek
ftell
??2@YAPAXI@Z
fread
fclose
strcmp
_wcslwr
sprintf
atoi
strchr
??3@YAXPAX@Z
strlen
strcat
_stricmp
memset
_access
strstr
strrchr
wcsstr
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ