DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
435bd438c4451bcc2b358edfd4556535_JaffaCakes118.dll
Resource
win7-20240704-en
Target
435bd438c4451bcc2b358edfd4556535_JaffaCakes118
Size
52KB
MD5
435bd438c4451bcc2b358edfd4556535
SHA1
21e0566dd7faab9b4c25b68dad8df039c80302c6
SHA256
eb7bf2c9c044f7d1cbc87594ae3cf9f7e6eb535f211dbd1d39c75134a0eb3ceb
SHA512
9ffade3c5a4d108a83ef444fc007d69346ec4c79509d7edbb61a6634ec8f1401c1b345479ca966cea8d66e2a3c58edb693b1f7952a27aa95e957bb1496417dfe
SSDEEP
768:gSuqrLR8jhHCAZq3kUffNvrDZOm6NcBjCdc3H4eWV5bJ3mS83n4gTLJAMQwZN2M7:gVqrSLZyfFPfFmc3NWVn3mSsqqTVv3
Checks for missing Authenticode signature.
resource |
---|
435bd438c4451bcc2b358edfd4556535_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FreeLibrary
CreateProcessA
RemoveDirectoryA
CreateThread
WideCharToMultiByte
lstrlenW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
MultiByteToWideChar
FindFirstFileA
GetShortPathNameA
GetModuleHandleA
GetSystemDirectoryA
MoveFileA
CreateDirectoryA
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
WritePrivateProfileStringA
ExitProcess
GetPrivateProfileStringA
FindNextFileA
DeleteFileA
Sleep
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
SetFileAttributesA
LocalFree
GetCommandLineW
Process32First
Process32Next
GetModuleFileNameA
CloseHandle
lstrlenA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegCreateKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strchr
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
memcmp
_purecall
memcpy
_access
strcat
fopen
fseek
ftell
??3@YAXPAX@Z
strcmp
strrchr
strcpy
wcsstr
_wcslwr
strstr
sprintf
??2@YAPAXI@Z
strncpy
_strlwr
memset
strncmp
strlen
fclose
fread
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ