DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
7710a75e554679b4f55dca99b31320f5_JaffaCakes118.dll
Resource
win7-20240708-en
Target
7710a75e554679b4f55dca99b31320f5_JaffaCakes118
Size
52KB
MD5
7710a75e554679b4f55dca99b31320f5
SHA1
8c19cbf3625e4c5757b92c5fdcfaf954216a17b4
SHA256
a8d606409e180544ec4a3ee8478360019f51e8127d88b04fd55affb1e79fc6b9
SHA512
2fb6229af0715778104f15e69115a8db27b87d941c9bf13e7596ab5241544c12205f85b573f899964bd163c46c70a8abbcc46ec5fe028eaf023d9165df3465ec
SSDEEP
1536:Zv6G4I2GoDQuPywNe/zXf5eJyRaA/kkKyI:vdoDQr5gEK
Checks for missing Authenticode signature.
resource |
---|
7710a75e554679b4f55dca99b31320f5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
LocalFree
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
FreeLibrary
GetProcAddress
LoadLibraryA
WideCharToMultiByte
lstrlenA
CloseHandle
WritePrivateProfileStringA
CreateThread
Process32Next
Process32First
CreateProcessA
GetSystemDirectoryA
GetExitCodeProcess
WaitForSingleObject
CreateDirectoryA
RemoveDirectoryA
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
GetCommandLineW
GetModuleFileNameA
Sleep
ExitProcess
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strrchr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_access
_wcslwr
wcsstr
strcat
fopen
fseek
ftell
fread
fclose
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
??3@YAXPAX@Z
strstr
strcmp
_strupr
atoi
memcpy
_purecall
??2@YAPAXI@Z
memcmp
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ