DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4881a1200a4de97f06eb1e5ed7113e6c_JaffaCakes118.dll
Resource
win7-20240704-en
Target
4881a1200a4de97f06eb1e5ed7113e6c_JaffaCakes118
Size
64KB
MD5
4881a1200a4de97f06eb1e5ed7113e6c
SHA1
79050ef259d697b8ddb8ee60d156a113d20832de
SHA256
585878207e00473d57d71590f316edca4d5c7dfed3f1dcd44f00356530ae8166
SHA512
6c4eec801f80238ce314bac8e3a49c7826263ab9e213d12d76ed3779301ae9e84b78862c4f7310fb850bf9f429b69e56b3e6a6f53703ab99c14b5604964f90ae
SSDEEP
1536:DzAwa2AUcdBzriwDS8FkIOdOGgC7U5ocI:PRdAJ3X9FbOcz5ocI
Checks for missing Authenticode signature.
resource |
---|
4881a1200a4de97f06eb1e5ed7113e6c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
WideCharToMultiByte
lstrlenW
CreateThread
CreateDirectoryA
ExitProcess
CreateProcessA
GetSystemDirectoryA
GetCurrentProcessId
RemoveDirectoryA
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
LocalFree
FreeLibrary
LoadLibraryA
GetProcAddress
MultiByteToWideChar
SetFileAttributesA
MoveFileA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
Sleep
CloseHandle
WritePrivateProfileStringA
GetModuleFileNameA
Process32Next
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strncmp
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
fopen
fseek
ftell
??2@YAPAXI@Z
fread
fclose
memcpy
_access
sprintf
memset
strlen
strcat
strcpy
??3@YAXPAX@Z
strcmp
strrchr
strncpy
strchr
_strlwr
strstr
wcsstr
_wcslwr
atoi
memcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ