DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4610b69955232b356f814504feab3747_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4610b69955232b356f814504feab3747_JaffaCakes118
Size
64KB
MD5
4610b69955232b356f814504feab3747
SHA1
df1f25037cf40309637cbd653b193d7d4c17d682
SHA256
4ca8528cb81eadedafb3299842edea1b0fe40f43709715aec1ea60bdaa45cb17
SHA512
bb00e7a9bca4beb156e4ff077e38ed3676a91f0c019f2fe3e688a1278c68be7f180e85cd0346d8783076d4ed68e8c50cee3e00415c9f32684bb40adacd35207d
SSDEEP
1536:G6WM6BsOwkJQxLzxOHzsCizaiJWmRE7+s1:PqQlsTTizaiJR7s1
Checks for missing Authenticode signature.
resource |
---|
4610b69955232b356f814504feab3747_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
ExitProcess
SetFileAttributesA
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetModuleHandleA
Process32Next
Process32First
CreateProcessA
GetSystemDirectoryA
MoveFileA
Sleep
CreateDirectoryA
CreateThread
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
LocalFree
GetCurrentProcessId
DeleteFileA
WritePrivateProfileStringA
CloseHandle
GetCommandLineW
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
FreeLibrary
GetProcAddress
GetShortPathNameA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
fclose
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
strncmp
strchr
strncpy
_access
_purecall
memcpy
strcmp
strrchr
memcmp
??3@YAXPAX@Z
strstr
sprintf
strlen
memset
strcat
strcpy
wcsstr
_wcslwr
_strupr
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ