DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3f320852b87c504aec4281643e50c25c_JaffaCakes118.dll
Resource
win7-20240705-en
Target
3f320852b87c504aec4281643e50c25c_JaffaCakes118
Size
48KB
MD5
3f320852b87c504aec4281643e50c25c
SHA1
02f37519d184ba0b7a08408274ec026e9b533ee9
SHA256
c286c8bb187aac036977dbb00b0ccc736d31ff1453fbbe529626352667124b10
SHA512
854f27f748f37654c1ee8da081216ea3686b06f3a59f69eee817fb34ca60c4d826c0701ba9a4edf4022f04a0b2d500c51a760fbc0ae959eecd9d77cb6d9a3452
SSDEEP
768:09U0Fo8HwT/SOg4cjDZz6D5ey+nTK+usiGbOpuFD2gXWclFKDnZOVRPPxAWPgxWv:QSYw+FI4yCWGbh6gXDF8UnPeWPgxy
Checks for missing Authenticode signature.
resource |
---|
3f320852b87c504aec4281643e50c25c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
GetSystemDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
CreateProcessA
Process32First
ExitProcess
RemoveDirectoryA
Sleep
LocalFree
GetCommandLineW
FreeLibrary
CreateThread
WaitForSingleObject
CloseHandle
GetExitCodeProcess
SetFileAttributesA
MoveFileA
CreateDirectoryA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
lstrlenW
WideCharToMultiByte
WritePrivateProfileStringA
lstrlenA
MultiByteToWideChar
GetProcAddress
LoadLibraryA
Process32Next
GetNamedSecurityInfoA
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
_wcslwr
wcsstr
??3@YAXPAX@Z
sprintf
strlen
strstr
strrchr
_access
strcat
memset
memcpy
_purecall
_strupr
memcmp
strcmp
strcpy
atoi
strchr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ