DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3cb32b6e9e95eac8e9b358855fdf926b_JaffaCakes118.dll
Resource
win7-20240705-en
Target
3cb32b6e9e95eac8e9b358855fdf926b_JaffaCakes118
Size
68KB
MD5
3cb32b6e9e95eac8e9b358855fdf926b
SHA1
8cad2027a867adc4abd9b819f20d8126606acac4
SHA256
d485e46f595e9923d74fb61042996d7e91af08e2ee8e352cfea9088fc036c3d0
SHA512
41c2875cc7ad6e6cfd636deb80ab93c56a95b709cbd6ee68ae8ab547e92d24c0fd50f3e1cc9693fdac082bd6c0f445d907e136d81ddf6d9223d71de06fa2305b
SSDEEP
1536:EQIdl0+6PQbQJqzZMQRj9+hcvTini0ShWjkrKtDk:Ol0++b3YJiniVhOkOtI
Checks for missing Authenticode signature.
resource |
---|
3cb32b6e9e95eac8e9b358855fdf926b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenW
WideCharToMultiByte
CreateProcessA
RemoveDirectoryA
CloseHandle
Sleep
SetFileAttributesA
GetSystemDirectoryA
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
LocalFree
GetProcAddress
GetCommandLineW
ExitProcess
GetModuleFileNameA
lstrlenA
MultiByteToWideChar
LoadLibraryA
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
CreateThread
FindNextFileA
MoveFileA
RegEnumKeyExA
RegSetValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
memset
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
_wcslwr
wcsstr
fopen
fseek
ftell
??2@YAPAXI@Z
fread
fclose
sprintf
??3@YAXPAX@Z
strstr
strrchr
strcmp
_access
strcat
memcmp
memcpy
strcpy
_strupr
strlen
strncpy
strchr
strncmp
atoi
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ