DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
441f565c8c8e1cf3af7e4a594c20aebe_JaffaCakes118.dll
Resource
win7-20240705-en
Target
441f565c8c8e1cf3af7e4a594c20aebe_JaffaCakes118
Size
60KB
MD5
441f565c8c8e1cf3af7e4a594c20aebe
SHA1
5d7351073e945808d9686851b30b12d553b64ef8
SHA256
d424040a18fbc71995bc481f09432b0017a35a7a3253eabec379a0bf603cdc1d
SHA512
589b5e89da0a00afcb79380cc01b5b6770e339af959834875f6a6801a8c6bce1dc4ca462294d9ce8b6645a20f1d0b8a4334c4ead6448a822108525cf3ca135c9
SSDEEP
1536:IB0N3Hcjq+8KWhhqLF7XpchkdgdhIZOqTS8o:I2V8jgqPgd0OqTS8
Checks for missing Authenticode signature.
resource |
---|
441f565c8c8e1cf3af7e4a594c20aebe_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
CreateDirectoryA
Process32Next
Process32First
CreateThread
WritePrivateProfileStringA
GetCurrentProcessId
ExitProcess
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetSystemDirectoryA
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteFileA
RemoveDirectoryA
Sleep
CreateProcessA
SetFileAttributesA
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
GetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strlen
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
fopen
fseek
ftell
fread
fclose
memcpy
_wcslwr
wcsstr
??3@YAXPAX@Z
strcat
strcpy
memset
sprintf
_access
memcmp
strstr
strcmp
strrchr
_strupr
atoi
strchr
strncpy
strncmp
??2@YAPAXI@Z
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ