DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
43b558dbeec2d872945f2d57331fca67_JaffaCakes118.dll
Resource
win7-20240705-en
Target
43b558dbeec2d872945f2d57331fca67_JaffaCakes118
Size
60KB
MD5
43b558dbeec2d872945f2d57331fca67
SHA1
a52da92dc5093778581901dda7e39d05e6de5384
SHA256
9c4a66590700476dae116fb8a2aa950f1cf4bbdb4c0f5246ca99b757a41be7f0
SHA512
9e095f499945202c89546b2023e47888aa9ae1660198c6af4fed39921db914fba500928e5aae6625154e08bfe94e5466564281b8bec29d4addd83b132309fedf
SSDEEP
1536:SPzLcsrMVXWhLWjeEjwF3Tae9n4J0W6XSyI1WF:wX4VYweEjwF3Zh4J0WiSy6W
Checks for missing Authenticode signature.
resource |
---|
43b558dbeec2d872945f2d57331fca67_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
Sleep
CreateDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
CreateThread
GetCommandLineW
RemoveDirectoryA
SetFileAttributesA
EnterCriticalSection
GetCurrentProcessId
MoveFileA
ExitProcess
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
lstrlenW
GetSystemDirectoryA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
LocalFree
WritePrivateProfileStringA
Process32First
Process32Next
CloseHandle
GetModuleFileNameA
DeleteFileA
LeaveCriticalSection
RegCreateKeyExA
RegSetValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcat
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
strcmp
_access
atoi
strncmp
strchr
strncpy
_wcslwr
wcsstr
memset
strlen
sprintf
??3@YAXPAX@Z
fclose
fread
??2@YAPAXI@Z
ftell
fseek
fopen
_strupr
strrchr
strcpy
strstr
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ