DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
6ae61cc69b67b129480bb198f095099a_JaffaCakes118.dll
Resource
win7-20240705-en
Target
6ae61cc69b67b129480bb198f095099a_JaffaCakes118
Size
60KB
MD5
6ae61cc69b67b129480bb198f095099a
SHA1
eac68060facefa123c846141f5ed46cdcbfb9a75
SHA256
1d9f0b49bcc101bb74c65450bffacf3dcdd041449c47f19285cefeafb9b5ae21
SHA512
300b8a16c1a0958c9465575274845a81b977c1804be7de546f8846194defc2e991cceed376d177f95b5b971873c3a5adb94a4f1aa32649178ced8048b5208d9a
SSDEEP
768:XLLoJVk+0jCOTu7cvJEE//2LlB7c3ZDQ7Va54LhKdWBCsgTwVGBammjPOAMuHX:7Ld9CH7c+EMgeY4LjgTwVGBXEOAMIX
Checks for missing Authenticode signature.
resource |
---|
6ae61cc69b67b129480bb198f095099a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateProcessA
RemoveDirectoryA
FreeLibrary
Sleep
GetSystemDirectoryA
MoveFileA
SetFileAttributesA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
CreateDirectoryA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
WritePrivateProfileStringA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
ExitProcess
Process32Next
Process32First
CreateThread
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetCurrentProcessId
LocalFree
CloseHandle
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
DeleteFileA
lstrlenW
GetShortPathNameA
GetNamedSecurityInfoA
RegEnumKeyExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strrchr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
_purecall
strcmp
_access
strchr
atoi
strstr
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
_strupr
sprintf
memcmp
memcpy
strlen
strcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ