DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
68f4e5f8f4ad4b13eca2a8cef29e7d1e_JaffaCakes118.dll
Resource
win7-20240705-en
Target
68f4e5f8f4ad4b13eca2a8cef29e7d1e_JaffaCakes118
Size
68KB
MD5
68f4e5f8f4ad4b13eca2a8cef29e7d1e
SHA1
28a8eda040846e0c37980cc833be3213852ecf73
SHA256
2f8f66dc1c798fee23f6a666007abe45899ee53707bfcf48f55eba085d4b0d7d
SHA512
8702791557d5f811f4afdb295a6922cb72baee972c9bb3c84f85ae3d512716755ae6a1500520c0617e010760fe74eec7d97cee00eac1fb0448f6a72bcb3bb61d
SSDEEP
1536:Fhrbhb5X15GgagXNmZ5bGv+wZvF7SpCp0+eTwhnk:fbX15zag4mcz+eank
Checks for missing Authenticode signature.
resource |
---|
68f4e5f8f4ad4b13eca2a8cef29e7d1e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32First
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
FindNextFileA
Process32Next
GetPrivateProfileStringA
FindFirstFileA
MoveFileA
ExitProcess
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
CreateDirectoryA
WritePrivateProfileStringA
GetCurrentProcessId
Sleep
DeleteFileA
RemoveDirectoryA
CreateProcessA
CloseHandle
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
LocalFree
CreateThread
SetFileAttributesA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strncpy
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
atoi
strcmp
_wcslwr
wcsstr
memset
??3@YAXPAX@Z
strlen
sprintf
memcmp
strstr
??2@YAPAXI@Z
strcat
strcpy
_access
_strlwr
strchr
strncmp
memcpy
_purecall
strrchr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ