DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3663e5f8931f9f02a9d6b1b1a595925d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3663e5f8931f9f02a9d6b1b1a595925d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3663e5f8931f9f02a9d6b1b1a595925d_JaffaCakes118
Size
52KB
MD5
3663e5f8931f9f02a9d6b1b1a595925d
SHA1
2325bf6cd91e482754a95fc0a91dc74fbdf3981b
SHA256
613eeb99f67cfd46a977f60eb531764ba96fbad207eef1635e39b6f52bc888bb
SHA512
cc744a3bdee4ae06ce8a794d56c10945e4f3fc5318fb45b54528052c2e163c35e8592511232a13dcf897ed2a7bddf72d1d62bfc7ad15c04b80f9c9bdd76682e1
SSDEEP
768:6XMNoe6mhGYkBVPMgF++mr/AkPz7U92lRM89hbZbDEJ7ZBN6f5gPVk0A:7oSGYyVC+e/JccFpwN6fmB
Checks for missing Authenticode signature.
Processes:
resource |
---|
3663e5f8931f9f02a9d6b1b1a595925d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
LocalFree
SetFileAttributesA
WritePrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
CreateThread
lstrlenW
WideCharToMultiByte
GetCurrentProcessId
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateProcessA
lstrlenA
MultiByteToWideChar
GetProcAddress
Process32First
Process32Next
CloseHandle
ExitProcess
GetModuleFileNameA
CreateDirectoryA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
LoadLibraryA
GetCommandLineW
FreeLibrary
MoveFileA
BuildExplicitAccessWithNameA
RegSetValueExA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
strlen
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
fopen
fseek
ftell
fread
fclose
strncmp
strncpy
memcpy
strstr
strrchr
sprintf
_access
strcat
strcmp
strcpy
??3@YAXPAX@Z
memset
??2@YAPAXI@Z
_strupr
atoi
strchr
wcsstr
_wcslwr
memcmp
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ