DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4b3daebb8cb817328c6e9e6954274855_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4b3daebb8cb817328c6e9e6954274855_JaffaCakes118
Size
60KB
MD5
4b3daebb8cb817328c6e9e6954274855
SHA1
71d102276201ed675f065cf35ec884c67cd76f34
SHA256
db61d2ed18030ac37691274a715f72045a5001ced9de3b91c6f6dd562f71bc34
SHA512
270d6f7f7160c1c830de89ba6762c176aa9bd13de2457d7c04a4e81547fa7a19bc3f5cb3d2ad55e2cd9a6ce300c4b34f0eb50f9952708da58ac844a34dd198d9
SSDEEP
1536:dFto1SwQ6At1aCxyt+gTzy9N+a1hFhVVw:OqT+Tz5IFhVVw
Checks for missing Authenticode signature.
resource |
---|
4b3daebb8cb817328c6e9e6954274855_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
lstrlenW
LeaveCriticalSection
EnterCriticalSection
lstrlenA
FreeLibrary
RemoveDirectoryA
ExitProcess
GetCommandLineW
LocalFree
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
LoadLibraryA
GetProcAddress
Process32First
Process32Next
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
CreateDirectoryA
Sleep
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
WritePrivateProfileStringA
GetExitCodeProcess
CreateThread
SetNamedSecurityInfoA
SetEntriesInAclA
RegDeleteKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
atoi
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_purecall
_wcslwr
wcsstr
fopen
fseek
ftell
??2@YAPAXI@Z
sprintf
memset
??3@YAXPAX@Z
_access
strcat
strlen
strcpy
memcmp
memcpy
strstr
_strupr
strchr
strcmp
strrchr
fclose
fread
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ