DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
423939f58d0b6fc3139690443a25bab3_JaffaCakes118.dll
Resource
win7-20240704-en
Target
423939f58d0b6fc3139690443a25bab3_JaffaCakes118
Size
64KB
MD5
423939f58d0b6fc3139690443a25bab3
SHA1
a0927ec776d463deb7b663445fcb92a05dda2f7e
SHA256
05b43b955029ea3db6b3b8d6ebb78a6970419a0422f8112d28517c2c65285ba7
SHA512
2357749b81660b317cd97640124741fbde8298135479cd973510f1d479c9657e3a68d5d146e257014f166e291d6088a0f521df4a618a606e6647fb8aa4a79089
SSDEEP
1536:7tsxxNJIHy+kPNE4FwnSg/HEqEUqmyjr:72xNGy++FSSXqEUq
Checks for missing Authenticode signature.
resource |
---|
423939f58d0b6fc3139690443a25bab3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
lstrlenW
WideCharToMultiByte
Sleep
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
MultiByteToWideChar
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
SetFileAttributesA
MoveFileA
ExitProcess
RemoveDirectoryA
CreateThread
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
WritePrivateProfileStringA
GetCurrentProcessId
Process32First
Process32Next
CloseHandle
CreateDirectoryA
GetModuleFileNameA
LoadLibraryA
LocalFree
GetProcAddress
InterlockedDecrement
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
sprintf
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
fopen
fseek
ftell
fread
fclose
??2@YAPAXI@Z
_purecall
strlen
memset
??3@YAXPAX@Z
strcmp
strrchr
strstr
wcsstr
_wcslwr
_access
strcat
strcpy
_stricmp
memcmp
memcpy
strncpy
strchr
strncmp
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ