DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4a90121c2a105e6191c29c0eb3c8eb0d_JaffaCakes118.dll
Resource
win7-20240704-en
Target
4a90121c2a105e6191c29c0eb3c8eb0d_JaffaCakes118
Size
60KB
MD5
4a90121c2a105e6191c29c0eb3c8eb0d
SHA1
4558322d913359dfe9032189ad28c38b78793149
SHA256
5e28d7db21d84786011a8996f5e1f1f9e598725394a50e42743ca0396b63814e
SHA512
c43854da7027106a070db391bbcd84b3c89556124fda40dee03bd31b523291432c6d4f70fe1c8562bf036fa49e030c20a1f4dd773ef0c03b1b36391eb8023fa3
SSDEEP
1536:wKZl3YrdOrddrTlKLjLgXXkhYYw2tQqw:wGYrdOrhUgXX0tQq
Checks for missing Authenticode signature.
resource |
---|
4a90121c2a105e6191c29c0eb3c8eb0d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
LocalFree
Sleep
CreateProcessA
RemoveDirectoryA
CreateDirectoryA
GetCommandLineW
GetSystemDirectoryA
GetExitCodeProcess
WaitForSingleObject
CreateThread
ExitProcess
Process32Next
Process32First
WritePrivateProfileStringA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
GetProcAddress
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetCurrentProcessId
FreeLibrary
SetNamedSecurityInfoA
SetEntriesInAclA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcat
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_access
fopen
fseek
ftell
fread
fclose
atoi
??3@YAXPAX@Z
sprintf
strlen
memcmp
strncpy
strchr
memset
strncmp
strcpy
strstr
_strupr
memcpy
_purecall
??2@YAPAXI@Z
strrchr
strcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ