DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
64ab3714cc19a387349c0b40847586c7_JaffaCakes118.dll
Resource
win7-20240708-en
Target
64ab3714cc19a387349c0b40847586c7_JaffaCakes118
Size
52KB
MD5
64ab3714cc19a387349c0b40847586c7
SHA1
5c05821c7d186fadbad80ceab20d9f7cac406fad
SHA256
6b894c224e0c1c2c3515f7403b184e08d9bc7bcc6e6af9372b5626af080de4e1
SHA512
3625e598ff3c4bd31574aef7ce82a272743d8fb7461c4c323aa01e1b170311f888ba067fe345f8b82a0ac596ed567b690d39d4d6fd80e0d89f1134631289890a
SSDEEP
1536:6RVH9pSeSEzyfSH8IkKeSsCDUXHd1HA8:GHW4VkE0Xd1g8
Checks for missing Authenticode signature.
resource |
---|
64ab3714cc19a387349c0b40847586c7_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
RemoveDirectoryA
Sleep
FreeLibrary
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
ExitProcess
lstrlenW
WideCharToMultiByte
DeleteFileA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
WritePrivateProfileStringA
EnterCriticalSection
LeaveCriticalSection
lstrlenA
MultiByteToWideChar
CreateThread
LoadLibraryA
GetProcAddress
Process32First
Process32Next
LocalFree
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CreateDirectoryA
CloseHandle
DisableThreadLibraryCalls
SetNamedSecurityInfoA
SetEntriesInAclA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
fclose
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
memcmp
strlen
strncmp
strncpy
strcmp
strstr
strrchr
??3@YAXPAX@Z
_access
strcat
atoi
strchr
memset
sprintf
strcpy
wcsstr
_wcslwr
_strlwr
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ