DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3fc1669b3dc63193cf4a9e1cbb7a2d0b_JaffaCakes118.dll
Resource
win7-20240705-en
Target
3fc1669b3dc63193cf4a9e1cbb7a2d0b_JaffaCakes118
Size
52KB
MD5
3fc1669b3dc63193cf4a9e1cbb7a2d0b
SHA1
a51e100ccda0a3bd3f4e66e240b8d92a4a565212
SHA256
29b02735f929cc5909170fa3028c5c9a07ad0ed99395703520caa70851fecf63
SHA512
040fee4f3240b5a69f32e1b3e1d608cfe7273b9b029bb9b21216fcfc58e163a62a5b09da13c180e16bc9086e624304e2f4b28944af3a1b2ffc990f7d61e62c29
SSDEEP
768:Jhq+QzZnfpZ6apwT2KsQeOlXtNjNCiw+c9RU7MsrJBVFDpXGoub5VLX4XDBeeu:ZaxaCo2VQ5l7p9AfuFNXGou3LsDBe
Checks for missing Authenticode signature.
resource |
---|
3fc1669b3dc63193cf4a9e1cbb7a2d0b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
ExitProcess
GetProcAddress
LoadLibraryA
MoveFileA
CreateThread
FreeLibrary
GetCurrentProcessId
InterlockedDecrement
WideCharToMultiByte
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetCommandLineW
WritePrivateProfileStringA
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
Process32First
Process32Next
CloseHandle
Sleep
LocalFree
DeleteService
ControlService
CloseServiceHandle
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
OpenSCManagerA
OpenServiceA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strcat
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcmp
_access
_wcslwr
wcsstr
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
strstr
strrchr
_strupr
??3@YAXPAX@Z
memcpy
_purecall
??2@YAPAXI@Z
memcmp
atoi
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ