DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
7659f409bb4dd66c13d1b467be1d0f6b_JaffaCakes118.dll
Resource
win7-20240708-en
Target
7659f409bb4dd66c13d1b467be1d0f6b_JaffaCakes118
Size
56KB
MD5
7659f409bb4dd66c13d1b467be1d0f6b
SHA1
dbe325d44815588e7ad0284d5375e7d9bbc844e6
SHA256
5940385b777fe29d59f7eb995a6c1b520929a52e82b9acd4ffcf3b717a8d3b27
SHA512
f2a5700a22da8beeb324605e8a088fe1fd393671a5cd3e9223a942b3f8a0c55e41cfc9b2ccb1c076637a89ebaebe0cc51e702423c7c023ad90475d0e4f7a7ba1
SSDEEP
1536:ywvDsyvxseS7tWwdLRTe1BcLPgDZkuNEDP3oE5:5Ds2xsbwcL9nLeZkpLoI
Checks for missing Authenticode signature.
resource |
---|
7659f409bb4dd66c13d1b467be1d0f6b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateThread
WritePrivateProfileStringA
MoveFileA
LoadLibraryA
CreateDirectoryA
ExitProcess
FreeLibrary
LocalFree
Sleep
Process32Next
Process32First
GetCommandLineW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
GetProcAddress
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcmp
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strncmp
strncpy
_wcslwr
wcsstr
strstr
memset
strrchr
sprintf
strcat
memcmp
memcpy
??3@YAXPAX@Z
strlen
strcpy
_stricmp
_purecall
??2@YAPAXI@Z
atoi
strchr
_access
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ