DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
616ff7c3476c3931ac76ebe9255cbf6f_JaffaCakes118.dll
Resource
win7-20240704-en
Target
616ff7c3476c3931ac76ebe9255cbf6f_JaffaCakes118
Size
52KB
MD5
616ff7c3476c3931ac76ebe9255cbf6f
SHA1
9d78aa16dfaa1af57703e942027ff99860c8a3af
SHA256
a724c196c20e9eba604dc06707d48aa2a55545bde14584a8a1db7a042651aeb3
SHA512
a132c7b15f72419f1c249abeb9ac70d7bf7d793b577a7f09c76bd4a476fafa813b99fd0d684cae2a8fe4c19d07e61db68ae2cc700e8275343f4eb516349a2325
SSDEEP
1536:OF6qNkOz3IJ3LmVc6aMfv6RVmxJhSBcyMNdVV:Z80w7SKy6
Checks for missing Authenticode signature.
resource |
---|
616ff7c3476c3931ac76ebe9255cbf6f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
lstrlenA
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
LoadLibraryA
Process32Next
Process32First
MoveFileA
SetFileAttributesA
WritePrivateProfileStringA
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateThread
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
ExitProcess
LocalFree
CreateDirectoryA
lstrlenW
WideCharToMultiByte
Sleep
GetCurrentProcessId
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
strstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
strcmp
memcpy
atoi
memcmp
fopen
fseek
ftell
fread
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
??3@YAXPAX@Z
_access
strcat
_strupr
??2@YAPAXI@Z
strrchr
wcsstr
_wcslwr
fclose
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ