DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
344211ffb3c9f8470b986e8bc092fa3c_JaffaCakes118.dll
Resource
win7-20240705-en
Target
344211ffb3c9f8470b986e8bc092fa3c_JaffaCakes118
Size
56KB
MD5
344211ffb3c9f8470b986e8bc092fa3c
SHA1
631d215dc7e459468016822464c60c1be0808984
SHA256
26446f86ce969affc2ff71c2e79e3be3150d45fe80395f618e43f926cde534fe
SHA512
752a896a8e92e67962ae36ba342d9c692548e03ffc762618931c5028fd63e5c9d9455dd9e00789bc0c543c532be09b4af4da1b0117b444bb0caaf573275a013d
SSDEEP
1536:MMoXXBn8bAqpzK8AjlgfP7uOpWtYVNg3a:MMoXXR8EqpzKuLNsa
Checks for missing Authenticode signature.
resource |
---|
344211ffb3c9f8470b986e8bc092fa3c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
GetShortPathNameA
GetModuleHandleA
SetFileAttributesA
lstrlenA
WideCharToMultiByte
Sleep
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
Process32Next
Process32First
MoveFileA
ExitProcess
GetExitCodeProcess
WaitForSingleObject
MultiByteToWideChar
GetProcAddress
GetCurrentProcessId
DeleteFileA
WritePrivateProfileStringA
GetCommandLineW
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
CreateDirectoryA
CreateThread
LoadLibraryA
FreeLibrary
LocalFree
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegEnumKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
ftell
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
strlen
strncmp
strncpy
memcmp
_purecall
memcpy
strstr
strcpy
wcsstr
_wcslwr
memset
??3@YAXPAX@Z
_access
strcat
sprintf
fclose
fread
??2@YAPAXI@Z
_strupr
fseek
fopen
strrchr
atoi
strchr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ