DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
667b7cf39f8b708d6c4c09f7de4ae01e_JaffaCakes118.dll
Resource
win7-20240704-en
Target
667b7cf39f8b708d6c4c09f7de4ae01e_JaffaCakes118
Size
76KB
MD5
667b7cf39f8b708d6c4c09f7de4ae01e
SHA1
cd677ad12c514bf6c561881c7ee8d23065c4dbaf
SHA256
d54272c923e38b4bf49db5a2727be289cdbff9faf087af29829f90a4333c66ca
SHA512
94135f2e1de114a3db5379b95e0a4d5393ec053793ad58a9bbe66892b6023d20dc5e7c5c768cb75f06137e90c235ee96be7e3adc87f7bb8f095ebdba36e861fd
SSDEEP
768:LEs4zpCWsz9HkBotk0gi82SzIoUV3VKR3UrHNPKbMOIFntw/BYvZLrEJvfPegd8i:LLWXo+CCMKR3UrHNPK4OI7N6OJFS
Checks for missing Authenticode signature.
resource |
---|
667b7cf39f8b708d6c4c09f7de4ae01e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
Process32Next
Process32First
SetFileAttributesA
CreateDirectoryA
FreeLibrary
DeleteFileA
LeaveCriticalSection
EnterCriticalSection
WritePrivateProfileStringA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CreateProcessA
MoveFileA
RemoveDirectoryA
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
ExitProcess
WaitForSingleObject
GetExitCodeProcess
CreateThread
LoadLibraryA
GetProcAddress
LocalFree
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
CloseHandle
lstrlenA
Sleep
MultiByteToWideChar
GetCurrentProcessId
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
memcmp
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
_purecall
_wcslwr
wcsstr
atoi
strrchr
fopen
fseek
ftell
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
??3@YAXPAX@Z
strstr
strcat
_strupr
memcpy
??2@YAPAXI@Z
_access
fclose
fread
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ