DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
822df445cf828574e414221177644676_JaffaCakes118.dll
Resource
win7-20240708-en
Target
822df445cf828574e414221177644676_JaffaCakes118
Size
52KB
MD5
822df445cf828574e414221177644676
SHA1
22064dfce699d4c5890db749843ec1603a297b20
SHA256
c8c4dc18aeed99a802513a3dc713be4def0c2177c17ff452ed19202eb3f3c766
SHA512
f9b34339f342a38c912562a64e65b1ec923b810a6baf98f41a2ac4578c9c942a8aaa2eeb2c0f7640bb815d5b3603e9cd41ab2fdf745697ce194e6306005ab909
SSDEEP
1536:DUmkSWlaTQwA5kJG1ql2O4oVM2xRslba+uXJ4:DUOmKpCU0uXJ
Checks for missing Authenticode signature.
resource |
---|
822df445cf828574e414221177644676_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
Sleep
ExitProcess
CreateDirectoryA
WideCharToMultiByte
CreateProcessA
RemoveDirectoryA
GetCommandLineW
MultiByteToWideChar
CloseHandle
GetSystemDirectoryA
CreateThread
GetExitCodeProcess
WaitForSingleObject
MoveFileA
SetFileAttributesA
Process32Next
Process32First
LocalFree
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetProcAddress
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
LoadLibraryA
WritePrivateProfileStringA
FreeLibrary
GetCurrentProcessId
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
GetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strncpy
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_wcslwr
wcsstr
strcmp
strcat
sprintf
atoi
strchr
strstr
strrchr
??3@YAXPAX@Z
memcpy
_purecall
??2@YAPAXI@Z
memcmp
_strupr
memset
strncmp
strlen
strcpy
_access
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ