DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
5d58c050b9f3fcce656978335aac81df_JaffaCakes118.dll
Resource
win7-20240704-en
Target
5d58c050b9f3fcce656978335aac81df_JaffaCakes118
Size
76KB
MD5
5d58c050b9f3fcce656978335aac81df
SHA1
4fd5464a45f01134865af78a7d72577c9e1f8c46
SHA256
189053fbeb3d0132b60584247b8210a74ab6bae94cec32f2365600cab3e79fbe
SHA512
e7a8cf567232ed1d8191e6042241d092a80ac39e5b2cbe6572a465c0a6f7fa321822b326ab1d34ed1ff1b87977883a341e06b3b29d0378206d1964ade906d04e
SSDEEP
1536:TpsQMIGyeCfkoDw0I2sFshLobhR/ZKJnrv:NsqFewvVXMVK5r
Checks for missing Authenticode signature.
resource |
---|
5d58c050b9f3fcce656978335aac81df_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapDestroy
lstrlenW
GetShortPathNameA
GetModuleHandleA
WideCharToMultiByte
ExitProcess
CreateDirectoryA
Sleep
GetCurrentProcessId
CloseHandle
CreateProcessA
InterlockedDecrement
Process32Next
Process32First
GetProcAddress
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
CreateThread
GetCommandLineW
MoveFileA
WritePrivateProfileStringA
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenA
MultiByteToWideChar
GetModuleFileNameA
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
LoadLibraryA
LocalFree
FreeLibrary
GetSystemDirectoryA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
memcmp
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strcpy
strcmp
fopen
fseek
ftell
fread
fclose
memset
strstr
??3@YAXPAX@Z
sprintf
??2@YAPAXI@Z
strrchr
strcat
strlen
memcpy
_purecall
_stricmp
atoi
strchr
wcsstr
_wcslwr
_access
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ