DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
607f3a4aee698cbe5f54bcadf5e2a3c3_JaffaCakes118.dll
Resource
win7-20240705-en
Target
607f3a4aee698cbe5f54bcadf5e2a3c3_JaffaCakes118
Size
52KB
MD5
607f3a4aee698cbe5f54bcadf5e2a3c3
SHA1
8e66da706ed54fdf4b8d94c75550807503dbc316
SHA256
0ae9e073d3956acc409dbb2817bd63704cb85b4781f65306a3670a51eb4b322c
SHA512
78be44fd7f154be6372253d25051e6b39c61f74cc665faa410f48785efcd104a0e808e5ec69892419551fedfff6fc8c163275e83a84497ccf63009c7d5b3e534
SSDEEP
1536:53ULQ9Guu6C8ZGfxKgYs9cidK5VHlOm8RwHpifu:pxpVmclVFOmHp
Checks for missing Authenticode signature.
resource |
---|
607f3a4aee698cbe5f54bcadf5e2a3c3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
CreateThread
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
LocalFree
ExitProcess
GetCurrentProcessId
Process32Next
Process32First
MoveFileA
LeaveCriticalSection
CreateDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
RemoveDirectoryA
GetCommandLineW
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
Sleep
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
??2@YAPAXI@Z
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
_purecall
_access
_wcslwr
wcsstr
memcpy
atoi
strcpy
strlen
strncmp
strstr
memset
strrchr
sprintf
strcat
??3@YAXPAX@Z
memcmp
strcmp
fclose
fread
_stricmp
ftell
fseek
fopen
strncpy
strchr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ