DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4815f018da75e56e9da32610c45b97fb_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4815f018da75e56e9da32610c45b97fb_JaffaCakes118
Size
60KB
MD5
4815f018da75e56e9da32610c45b97fb
SHA1
a07ad457a2dfb6b9ea538a9af3f817788ef79de6
SHA256
7541776dbeff84329f462e0ab670e621cd059aa653bd1ceb2c4fe00bee0ed8ec
SHA512
10f24a104871f5f4a474130bfa1ffa98d738f527e78ba7e3879d97103bfc72d6a01e9b3f3b56a80d0945945c8e369c226779c474d64ae972159420506619b67c
SSDEEP
1536:EUYud+bRxOKQRRgfWTCOGooNkCDNpfqfWE:Gud+buKQRRgfFhdBqfWE
Checks for missing Authenticode signature.
resource |
---|
4815f018da75e56e9da32610c45b97fb_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCommandLineW
Sleep
LocalFree
SetFileAttributesA
CloseHandle
CreateProcessA
GetSystemDirectoryA
CreateThread
MoveFileA
RemoveDirectoryA
WritePrivateProfileStringA
GetModuleHandleA
Process32First
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
FreeLibrary
LoadLibraryA
CreateDirectoryA
GetProcAddress
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
ExitProcess
GetShortPathNameA
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
GetModuleFileNameA
DeleteFileA
Process32Next
RegSetValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
fseek
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
atoi
_access
strcpy
strlen
strncmp
strchr
strncpy
??3@YAXPAX@Z
sprintf
strstr
??2@YAPAXI@Z
strcmp
strrchr
fclose
fread
memset
ftell
_strlwr
fopen
strcat
memcmp
memcpy
_purecall
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ