DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3cf1f222bdf77491ba10d09f27aeff53_JaffaCakes118.dll
Resource
win7-20240705-en
Target
3cf1f222bdf77491ba10d09f27aeff53_JaffaCakes118
Size
48KB
MD5
3cf1f222bdf77491ba10d09f27aeff53
SHA1
6bfe50e5a30a6617ad8ac31ee35df67785c2ec02
SHA256
57f8242a6ac90be40784486104b68fa38cb5a1b9a33ecdad23a5f1899ed90e90
SHA512
4c4409eb0a9de08ec96afb5f94ec2b4d38c819e3e535f0f29ad4cc669b1213ae618c279460a9f79a7ebc5b1320c82795856ab4c120843eca1823c47ff663996c
SSDEEP
768:GxHjUJcZ1+XkHeHuDlvDl4JSg3+MYUZLUizZg3NUZ1Ffm/DxFNJmQMJr5ZUgkm0:+DR1+2eODNDlA3+MYGEYFf6DrNJcJX5
Checks for missing Authenticode signature.
resource |
---|
3cf1f222bdf77491ba10d09f27aeff53_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
CreateThread
GetCommandLineW
CreateDirectoryA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
ExitProcess
GetExitCodeProcess
WaitForSingleObject
MoveFileA
LeaveCriticalSection
MultiByteToWideChar
Sleep
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
FreeLibrary
GetCurrentProcessId
SetFileAttributesA
LocalFree
lstrlenW
WideCharToMultiByte
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
GetModuleFileNameA
DeleteFileA
RemoveDirectoryA
CreateProcessA
Process32First
CloseHandle
Process32Next
EnterCriticalSection
RegSetValueExA
RegCreateKeyExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcmp
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
strncmp
strncpy
_wcslwr
wcsstr
fopen
fseek
ftell
strcpy
strcat
memset
_access
sprintf
??3@YAXPAX@Z
strlen
atoi
strchr
strstr
_strupr
strrchr
memcmp
fclose
fread
??2@YAPAXI@Z
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ