DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
651aa7d973116c831de7e966dae653a5_JaffaCakes118.dll
Resource
win7-20240704-en
Target
651aa7d973116c831de7e966dae653a5_JaffaCakes118
Size
56KB
MD5
651aa7d973116c831de7e966dae653a5
SHA1
92eae873f31898e40d604105a7fcd15b23b98fb3
SHA256
100eda1aa362233de6e93f0a541f2155d6b4a83649d70ebcd1252d256d29f426
SHA512
59a7d9c4ada1a73f043d9fec89b75f6dacd983c284d9bfebe8d69224ab320d77791cd90986b3eb7c70f2d1f2f9e31519b12ba073904a7a5bd658b91378074be6
SSDEEP
768:lIRd78GtpgZTmrZomadP+rIrcY2bQUJL7lxGyMccDqm4KfcQEW86hhvGNBtMx:lSdwzCh98rGJ9fMQKfaW86hhvMBGx
Checks for missing Authenticode signature.
resource |
---|
651aa7d973116c831de7e966dae653a5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
FreeLibrary
LocalFree
CloseHandle
GetSystemDirectoryA
InitializeCriticalSection
Process32Next
Process32First
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
WritePrivateProfileStringA
CreateDirectoryA
CreateThread
ExitProcess
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
GetCurrentProcessId
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
CreateProcessA
GetModuleFileNameA
DeleteFileA
Sleep
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
sprintf
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_access
atoi
strncmp
strchr
strncpy
_purecall
_wcslwr
wcsstr
strcmp
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
strrchr
_strlwr
strlen
strcpy
strstr
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ