DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3d5fb49602e8a14f4966871bd71e67d8_JaffaCakes118.dll
Resource
win7-20240708-en
Target
3d5fb49602e8a14f4966871bd71e67d8_JaffaCakes118
Size
64KB
MD5
3d5fb49602e8a14f4966871bd71e67d8
SHA1
031a4eec4b5e0e53779f3552f8f2faf5c4519cdc
SHA256
1cb1dbf68d43bc7c56755fe259b20e7e8bee5854c813ef68d0d7963b4dcfec32
SHA512
dcfc64f27dbceb7198a8d140b83eb67cb9a563e3eb72519ac0d1d27f5ab10dde3358d4b39c63a79eb383ef9a681bb7addded80c6be2537e97054328d00f9ae06
SSDEEP
1536:qDaX4deYJ/i4StofAVnr8SqqsRdpJsG3:fvLo01WJh3
Checks for missing Authenticode signature.
resource |
---|
3d5fb49602e8a14f4966871bd71e67d8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetPrivateProfileStringA
FindFirstFileA
lstrlenA
WritePrivateProfileStringA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
FindNextFileA
GetShortPathNameA
GetModuleHandleA
LocalFree
Sleep
ExitProcess
GetCommandLineW
RemoveDirectoryA
GetCurrentProcessId
Process32Next
Process32First
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
GetProcAddress
lstrlenW
WideCharToMultiByte
CreateDirectoryA
CreateThread
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
FreeLibrary
LoadLibraryA
HeapDestroy
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
fread
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcpy
strncmp
strncpy
strcmp
strchr
atoi
_wcslwr
wcsstr
_purecall
??3@YAXPAX@Z
strstr
sprintf
strlen
??2@YAPAXI@Z
_access
strcat
memset
strrchr
fclose
_stricmp
ftell
fseek
fopen
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ