CheckSwizzor
GetPCleanVirusName
PolyCleanFile
PolyCleanFileEx
PolyCleanFileM
Static task
static1
Behavioral task
behavioral1
Sample
PClean.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
PClean.dll
Resource
win10v2004-20240709-en
Target
6f512b96bb10d7c5cb77f486fcc4b4da_JaffaCakes118
Size
216KB
MD5
6f512b96bb10d7c5cb77f486fcc4b4da
SHA1
d4b93b686a75b51dfd17ac8a4206d0adbe445395
SHA256
2d96109ec25cc57dfe7065b924a9150ba3367e9d085e645601e37c0a8876d4e3
SHA512
98c110fc0c4ab5af214948311c5568a948b9cbc4412964a1dafb5e5b001a86e7f6a33c1c2e4cfcb8714d676921b9f137e61b7bfa9f4a4c4393f7d6bba8f1d633
SSDEEP
6144:bIIWgXUVqxqU3WtWjkTRGOwyUUqX/3NN+BXnd:7aqxqU3TJO1Ovj+lnd
Checks for missing Authenticode signature.
resource |
---|
unpack001/PClean.dll |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32Next
Process32First
CreateToolhelp32Snapshot
GetVersion
GetCurrentProcess
CopyFileA
DeleteFileA
Sleep
GetLocalTime
SetFileAttributesA
IsBadReadPtr
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
WritePrivateProfileStringA
WaitForSingleObject
GetModuleHandleA
CreateProcessA
GetPrivateProfileStringA
OpenProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
FlushViewOfFile
MoveFileExA
WinExec
GetShortPathNameA
GetWindowsDirectoryA
GetFileAttributesA
GetSystemDirectoryA
GetTempPathA
MoveFileA
QueryPerformanceCounter
CreateThread
GetCurrentThreadId
CreateDirectoryA
InterlockedExchange
TerminateProcess
GetLastError
CreateFileA
GetFileSize
CloseHandle
SetFilePointer
ReadFile
WriteFile
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetDriveTypeA
FreeLibrary
RaiseException
GetOEMCP
GetACP
LCMapStringW
LCMapStringA
HeapFree
HeapAlloc
RtlUnwind
HeapReAlloc
GetFileType
SetEndOfFile
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
IsBadWritePtr
FlushFileBuffers
SetHandleCount
GetStdHandle
GetStartupInfoA
HeapSize
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetStdHandle
InterlockedDecrement
InterlockedIncrement
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadCodePtr
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
MessageBoxA
wsprintfA
SetEntriesInAclA
SetSecurityInfo
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
AllocateAndInitializeSid
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
SHDeleteValueA
PathRemoveExtensionA
PathFindFileNameA
PathRemoveFileSpecA
PathFileExistsA
CheckSwizzor
GetPCleanVirusName
PolyCleanFile
PolyCleanFileEx
PolyCleanFileM
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ