DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3e9707d85f71d45cf197a4bde1c3aeb9_JaffaCakes118.dll
Resource
win7-20240705-en
Target
3e9707d85f71d45cf197a4bde1c3aeb9_JaffaCakes118
Size
64KB
MD5
3e9707d85f71d45cf197a4bde1c3aeb9
SHA1
60e03915e33e653c03e2a5b6f550ed58ac61f653
SHA256
14fc69cb0561cb6cc119a14a264d09033955f054ac0833f96a4a1bab362cd63e
SHA512
ae1c95aa3676c79d9ee5c430cc98373f74cad2591bd7ec8cc7b158c16d9d23bd8deb86ea3353b8f9b7926e3506482089f0cf95fb2d5dda19757331a66f2f1b57
SSDEEP
768:38k137jIsuMvUSaoLZSbINY5WZ6zoev99O4qrUcj+bEsox9FR0ciVpVO4pfW1r2J:JVzuMJE02oQ9O4qnPF65VpVOUSr2c8L
Checks for missing Authenticode signature.
resource |
---|
3e9707d85f71d45cf197a4bde1c3aeb9_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
LocalFree
CreateProcessA
RemoveDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateThread
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
CreateDirectoryA
CloseHandle
ExitProcess
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
lstrlenW
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
Sleep
WritePrivateProfileStringA
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
memset
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_wcslwr
wcsstr
_access
strcpy
_purecall
strchr
atoi
strstr
sprintf
??3@YAXPAX@Z
strlen
memcmp
memcpy
strcmp
strrchr
fclose
fread
_stricmp
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ