DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
41f457689d210335c697bdc03b800baa_JaffaCakes118.dll
Resource
win7-20240708-en
Target
41f457689d210335c697bdc03b800baa_JaffaCakes118
Size
60KB
MD5
41f457689d210335c697bdc03b800baa
SHA1
f60e5a3afcf31d75e93a408f8e1be121e2bc42c4
SHA256
40fb3e5dd6921ef14be4fee8ae6197d68f5f6453c4d5c16353f5d43908b38933
SHA512
b0f9349316a4fa103e70c5c1f0cdc6305c67af7704acdc9e7ab2bdb483a7b2540de519d42a116e16e5d15ffa507a35b423feeadc1dc5a82b3185cbd90b6ef67f
SSDEEP
1536:WZbxn7QlmlIPP9pRIG4Wsub3Pqxmqzu7NntH:+BaDFqubfWa7Bt
Checks for missing Authenticode signature.
resource |
---|
41f457689d210335c697bdc03b800baa_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
LocalFree
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
RemoveDirectoryA
WritePrivateProfileStringA
CreateDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
CreateProcessA
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
ExitProcess
GetCommandLineW
MoveFileA
WaitForSingleObject
GetExitCodeProcess
SetFileAttributesA
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
Process32First
Process32Next
CloseHandle
FreeLibrary
Sleep
DeleteFileA
GetCurrentProcessId
CreateThread
GetModuleFileNameA
GetProcAddress
LoadLibraryA
DeleteCriticalSection
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcat
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_purecall
memcpy
_access
atoi
memcmp
strcmp
strcpy
??3@YAXPAX@Z
memset
strlen
sprintf
fclose
fread
??2@YAPAXI@Z
ftell
fseek
fopen
_strupr
strrchr
strstr
strncpy
strchr
strncmp
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ