DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
404cb51c4edce6f49bf64c6207e1e163_JaffaCakes118.dll
Resource
win7-20240704-en
Target
404cb51c4edce6f49bf64c6207e1e163_JaffaCakes118
Size
60KB
MD5
404cb51c4edce6f49bf64c6207e1e163
SHA1
c9a32c027b2c4068b5c183fab816da2c22edbf42
SHA256
6c5703828dba97e3dd533738d54226822860d5466b853cabda0196610fa7a647
SHA512
f8e1023fe00b662061f9117c9cd0483bc2b00c3f61cc8795b0e6da0c4850d2888cb6ad78cd39cec4dc69c02b2852bee5f0e57e8cf39eea5f2cbdc7e9c645b5be
SSDEEP
1536:YI8+KwLRJbN9AoZQbY0F42Nk7M8GlG7Me:/DXPNB0F4MCnGlG4e
Checks for missing Authenticode signature.
resource |
---|
404cb51c4edce6f49bf64c6207e1e163_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
lstrlenA
CreateDirectoryA
Process32Next
Process32First
GetCommandLineW
Sleep
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
RemoveDirectoryA
LocalFree
CreateThread
WritePrivateProfileStringA
GetCurrentProcessId
MoveFileA
lstrlenW
WideCharToMultiByte
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
GetProcAddress
LoadLibraryA
FreeLibrary
ExitProcess
GetSystemDirectoryA
CreateProcessA
WaitForSingleObject
CloseHandle
GetModuleFileNameA
GetExitCodeProcess
EnterCriticalSection
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegQueryValueExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
_access
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
atoi
_wcslwr
wcsstr
??2@YAPAXI@Z
memset
strlen
sprintf
strstr
strcat
strcpy
??3@YAXPAX@Z
strrchr
memcmp
memcpy
_strlwr
strcmp
strncpy
strchr
strncmp
_purecall
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ