DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
39a5a9435a6a23b54edbcca411ae020d_JaffaCakes118.dll
Resource
win7-20240705-en
Target
39a5a9435a6a23b54edbcca411ae020d_JaffaCakes118
Size
60KB
MD5
39a5a9435a6a23b54edbcca411ae020d
SHA1
2a30870b6679d207c078462e4560215686ac246d
SHA256
946cf8a2d0f8a962ae0b8c832aaf1bf6aa289f7e5cfd9b630adfbf5f4044c0e3
SHA512
736477d5c12993353d8d6a80df1be749c7bc9e811d47eb9930ee25158580b40085129a718446d18ffab55c0fd113991e67d2d1550fdcb0f07e588c6461694670
SSDEEP
768:O6Nkhaa7OKyWWqYLter3EQopIbZQtLdUXOEfjkk+k48RUOvjX+2CkmSMZjtWpkCh:WgnHRLmlBG0vIk7oOvjXCkmxjKkW
Checks for missing Authenticode signature.
resource |
---|
39a5a9435a6a23b54edbcca411ae020d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
lstrlenW
GetModuleFileNameA
CreateThread
ExitProcess
CloseHandle
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
GetCommandLineW
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
LocalFree
CreateDirectoryA
WritePrivateProfileStringA
MultiByteToWideChar
SetFileAttributesA
MoveFileA
Sleep
GetCurrentProcessId
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
DeleteFileA
EnterCriticalSection
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
wcsstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
fopen
fseek
ftell
fread
fclose
_purecall
memcpy
strstr
strrchr
sprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
strlen
_access
strcat
memset
memcmp
_strupr
_wcslwr
strncpy
strchr
strncmp
strcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ