DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
6f36baa0d57d02a79345261d781b1ff3_JaffaCakes118.dll
Resource
win7-20240704-en
Target
6f36baa0d57d02a79345261d781b1ff3_JaffaCakes118
Size
52KB
MD5
6f36baa0d57d02a79345261d781b1ff3
SHA1
5468f146ce6de58bc71445c46201e52cfc26a658
SHA256
272ad189bdbce37a1aa6d1010b2fa6a2bb1ff98165a4f28d6846b50a91912a12
SHA512
8375062d1bc3bd6126565cf96c3e964d5aeeab5733894baecc8f0c2c335dee9ea53cb20219350342610450bd8cc47d0d2c6ff2fe9ee3fe19fafddb4820f9d027
SSDEEP
1536:fK8yt/8yPzdFJJpBiVH8gwuiYmxLSM2wCWn:Wd8yPWcgv+LS5w5n
Checks for missing Authenticode signature.
resource |
---|
6f36baa0d57d02a79345261d781b1ff3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
WritePrivateProfileStringA
lstrlenW
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
Process32Next
Process32First
CreateDirectoryA
GetCommandLineW
DisableThreadLibraryCalls
GetSystemDirectoryA
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
GetCurrentProcessId
WaitForSingleObject
GetExitCodeProcess
GetModuleFileNameA
FreeLibrary
CloseHandle
CreateThread
SetFileAttributesA
LocalFree
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
LoadLibraryA
GetProcAddress
DeleteFileA
RemoveDirectoryA
ExitProcess
CreateProcessA
InitializeCriticalSection
RegEnumKeyExA
RegSetValueExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
wcsstr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
atoi
strncmp
strchr
strncpy
_purecall
fopen
fseek
ftell
??2@YAPAXI@Z
strcat
strcpy
memset
_access
sprintf
??3@YAXPAX@Z
strstr
strrchr
strlen
strcmp
_strupr
_wcslwr
memcmp
memcpy
fclose
fread
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ