DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
4db3fb7771fafdde5551dcf25d63553f_JaffaCakes118.dll
Resource
win7-20240708-en
Target
4db3fb7771fafdde5551dcf25d63553f_JaffaCakes118
Size
64KB
MD5
4db3fb7771fafdde5551dcf25d63553f
SHA1
c05184dc6f9ea1ce2a74df350e2cc35916467949
SHA256
13cedf684bbe8d3f88a48a6cb87a9e36410f5e5ec3a04d4a56bb41cfd564920f
SHA512
11b040d660e7781b063642b7e999498549c1fc6f66157943e8b22184776d4643965063ec58a514659fe0e4329fa34b8fadfb469443b04a95f77d52437dbd478c
SSDEEP
768:DN9NFPM2DYonZTT6huxqopJiVESdHt5QBnah3O/HpqZT3W0/eM2k+BmjTstnJSS+:PNC2t+oynMOOfAG0Lbg5DsQ2
Checks for missing Authenticode signature.
resource |
---|
4db3fb7771fafdde5551dcf25d63553f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
WideCharToMultiByte
CloseHandle
CreateProcessA
GetSystemDirectoryA
CreateDirectoryA
GetProcAddress
LoadLibraryA
FreeLibrary
CreateThread
GetCommandLineW
SetFileAttributesA
RemoveDirectoryA
Sleep
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
MoveFileA
LocalFree
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringA
DisableThreadLibraryCalls
DeleteFileA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strcat
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_wcslwr
wcsstr
strchr
atoi
strcpy
fopen
fseek
strstr
??3@YAXPAX@Z
sprintf
memcpy
_purecall
??2@YAPAXI@Z
memcmp
memset
strlen
_access
_strupr
strcmp
strrchr
fclose
fread
ftell
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ