DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4bcd7fa99ab852d1b60bbfe043d77dc3_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4bcd7fa99ab852d1b60bbfe043d77dc3_JaffaCakes118
Size
64KB
MD5
4bcd7fa99ab852d1b60bbfe043d77dc3
SHA1
7576b5d15a8172a6168145fcab53e6cad0ab9c47
SHA256
d097890105f975e487770e0f3a7effe27c8c6de562692cd67b50ac277f780a0b
SHA512
73219f19a3ae901fb14525eb47ca97908991333e18012e4fd56d48854950334da3bbeb2dfc0e530bed276a1ea7cd7ce31339811417538d7978c9d463122aa3f7
SSDEEP
768:g3T05VAA6G6BwRTHR0ZQcZbQeXGJsoJb0dR3ws+mvZ1Z0de/z3KGg6MK9+J3XLUN:iBA6DBqR06pEGJsCcwi55zZgXKSXLUN
Checks for missing Authenticode signature.
resource |
---|
4bcd7fa99ab852d1b60bbfe043d77dc3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
CreateThread
GetExitCodeProcess
WaitForSingleObject
WritePrivateProfileStringA
ExitProcess
FreeLibrary
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
Process32First
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
Process32Next
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
SetFileAttributesA
CreateDirectoryA
DeleteFileA
RemoveDirectoryA
Sleep
LoadLibraryA
GetProcAddress
LocalFree
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
GetCommandLineW
CloseHandle
lstrlenA
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
_access
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
fopen
fseek
ftell
fread
fclose
strcmp
atoi
sprintf
strstr
memset
??3@YAXPAX@Z
strncpy
strchr
strncmp
strlen
strcpy
strcat
_strupr
strrchr
wcsstr
_wcslwr
memcmp
??2@YAPAXI@Z
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ