DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3d0437e261b35b207a4538358caad52a_JaffaCakes118.dll
Resource
win7-20240704-en
Target
3d0437e261b35b207a4538358caad52a_JaffaCakes118
Size
60KB
MD5
3d0437e261b35b207a4538358caad52a
SHA1
4a0bb7b994673c0500561d0634bfe7838374303b
SHA256
8f98dc2a7cd801a33119d4c12383084901d9e78eec7d0a97287f13196de0f42f
SHA512
a8f3edd48f64c55dc2a4b47b3433e591dc69a3fb5cfe7d5911ecbe606af65e5fd5022dc33c3a1101c923c0da1be176d89c45016ec09fe0ee5801cd04cb004400
SSDEEP
1536:koHIB/6toQT1iF99LsF288uDOXoIA0g0x:krBCzkDAOXTA0g0
Checks for missing Authenticode signature.
resource |
---|
3d0437e261b35b207a4538358caad52a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
FreeLibrary
LoadLibraryA
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
GetCurrentProcessId
CreateDirectoryA
MoveFileA
LeaveCriticalSection
GetProcAddress
lstrlenA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
DeleteFileA
RemoveDirectoryA
lstrlenW
WideCharToMultiByte
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
LocalFree
WritePrivateProfileStringA
Sleep
Process32First
Process32Next
CloseHandle
CreateThread
ExitProcess
MultiByteToWideChar
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
_access
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_purecall
memcpy
memcmp
_wcslwr
??3@YAXPAX@Z
sprintf
strstr
??2@YAPAXI@Z
strcpy
memset
strlen
strcat
strcmp
strrchr
_strlwr
atoi
strchr
strncpy
strncmp
wcsstr
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ