DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
7535b6a304fd70718c23cca18e130398_JaffaCakes118.dll
Resource
win7-20240705-en
Target
7535b6a304fd70718c23cca18e130398_JaffaCakes118
Size
52KB
MD5
7535b6a304fd70718c23cca18e130398
SHA1
371d0260213bc0e734b6e97d84a7ae206c3271cc
SHA256
020d8736e45284f5648171676132cda0c3d61b54d921bf2d25401c329860d9f8
SHA512
08f99fc4ffe7e72a70ce4c3f01ad5e9b8c8069a10e872e597c51c9c2c9d85198941ecac24d7c527faf176f7c39a6f4637e42bfc2f4b630e9021aad8d0487049a
SSDEEP
1536:8ekmv5WytSQcqEe51GwZXRnpRDwk2ileS/Yxbp3t:IyQAGwvfD8S/E3t
Checks for missing Authenticode signature.
resource |
---|
7535b6a304fd70718c23cca18e130398_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
RemoveDirectoryA
DeleteFileA
GetProcAddress
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
CreateProcessA
SetFileAttributesA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CreateDirectoryA
Sleep
WritePrivateProfileStringA
MoveFileA
GetCurrentProcessId
Process32Next
Process32First
CreateThread
WaitForSingleObject
CloseHandle
GetExitCodeProcess
ExitProcess
LocalFree
GetCommandLineW
LoadLibraryA
FreeLibrary
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
GetModuleHandleA
BuildExplicitAccessWithNameA
RegQueryValueExA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcmp
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strlen
strncmp
strncpy
_purecall
memcmp
memcpy
??3@YAXPAX@Z
strstr
sprintf
??2@YAPAXI@Z
atoi
strchr
wcsstr
_wcslwr
_stricmp
strrchr
memset
strcat
strcpy
_access
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ