DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
5e1c98e6c75087a81060af0a13b54bb2_JaffaCakes118.dll
Resource
win7-20240708-en
Target
5e1c98e6c75087a81060af0a13b54bb2_JaffaCakes118
Size
48KB
MD5
5e1c98e6c75087a81060af0a13b54bb2
SHA1
c8ce2f74e9b2fed6d906be08a678681fcac159e3
SHA256
0b75470a409ccb1a61c7f5f7eaeeebb27d2da315002ef74fed622d6aa813a58b
SHA512
bf71e26a7fd382cbb341a730bbb96eea941965d2162dd3ffdf3c846bfdd0e6a71b519d8572dff743735de3497d5f6862e48927b59ff3038d23d217e0c4a0b34d
SSDEEP
768:wY85/DIG2tXbKr1N6qjHrlroIsB431ZqLKjVdFOy7ZCXEJuihZ89i1Wu9Bfg+:e/DhkuD6q79oItqmLPCsU94Lp
Checks for missing Authenticode signature.
resource |
---|
5e1c98e6c75087a81060af0a13b54bb2_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MoveFileA
FreeLibrary
Sleep
CreateThread
Process32Next
Process32First
LocalFree
WritePrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
CreateDirectoryA
CloseHandle
GetCurrentProcessId
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
LoadLibraryA
GetProcAddress
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
_access
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
_purecall
_wcslwr
wcsstr
atoi
strncmp
strchr
strncpy
strcmp
fopen
strstr
memset
strrchr
sprintf
strcat
??3@YAXPAX@Z
memcmp
memcpy
strlen
strcpy
_stricmp
fclose
fread
??2@YAPAXI@Z
ftell
fseek
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ