DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
60b55e26b790fa74121c3989598ad84c_JaffaCakes118.dll
Resource
win7-20240704-en
Target
60b55e26b790fa74121c3989598ad84c_JaffaCakes118
Size
52KB
MD5
60b55e26b790fa74121c3989598ad84c
SHA1
6cc06ee4a30d65905eb2a4b4e7c597cdfadae2e9
SHA256
fec4b7fcf60fa6ed7b145363d1406a9d987a0ac0e123c5c982e4f69cb3d633f0
SHA512
c31f8a693dfdc7e43d9cb6d6c41c79683f35a3f115ec9d3c78cb918efdf50f03a2f20f280c37b7036cafbc577b5b1ec9900bce1113044519ccc4c7be32e2d4e8
SSDEEP
1536:T4ENQp7lbLNDSDHOrXH6ZEaFBC4OU+7b1oXNFOyN:RkHxQEaFBNcpoKQ
Checks for missing Authenticode signature.
resource |
---|
60b55e26b790fa74121c3989598ad84c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
Process32Next
Process32First
ExitProcess
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
CreateThread
GetCurrentProcessId
WritePrivateProfileStringA
CreateDirectoryA
GetCommandLineW
LocalFree
CloseHandle
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
InitializeCriticalSection
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
atoi
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strcmp
_purecall
fopen
fseek
ftell
??2@YAPAXI@Z
fread
fclose
_wcslwr
strstr
memset
strrchr
sprintf
strcat
memcmp
??3@YAXPAX@Z
memcpy
strlen
strcpy
_stricmp
strchr
strncpy
strncmp
_access
wcsstr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ