DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
8306d3bbd47c0bfb7c09dddb2fb8893a_JaffaCakes118.dll
Resource
win7-20240705-en
Target
8306d3bbd47c0bfb7c09dddb2fb8893a_JaffaCakes118
Size
52KB
MD5
8306d3bbd47c0bfb7c09dddb2fb8893a
SHA1
f780c1201d1d32b2ce1a0b70ebeb495621dd4cfd
SHA256
963f9ee06e2a072c7cb010fb8b15a4eb8bc3a23d8479be52df99a5113fd98b41
SHA512
c5884b10cac3598b52efaa2b870adfeb53c9f1d9a5d121b4ecf371db72af790c01c99f839abf77cb70cd7e9676c2b23e5819361b14b6e0712931576cdd2ec017
SSDEEP
1536:A1Ic/Fc37IS3H1UuwcDvHh0FrYEDKOKKoNY6HRgF:vcw3DvB0FrPcKoNBRgF
Checks for missing Authenticode signature.
resource |
---|
8306d3bbd47c0bfb7c09dddb2fb8893a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
lstrlenW
Sleep
GetCurrentProcessId
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCommandLineW
ExitProcess
WritePrivateProfileStringA
Process32Next
Process32First
LocalFree
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
CreateThread
RemoveDirectoryA
lstrlenA
LoadLibraryA
GetProcAddress
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
GetModuleFileNameA
MoveFileA
DisableThreadLibraryCalls
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strchr
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
_access
_wcslwr
wcsstr
_purecall
memcpy
strcat
fopen
fseek
??3@YAXPAX@Z
sprintf
strstr
??2@YAPAXI@Z
strcmp
strrchr
strlen
memset
memcmp
strncpy
_stricmp
strncmp
strcpy
fclose
fread
ftell
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ