DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
83dc8257abc94bc76ddbdf5e8bfc1b5d_JaffaCakes118.dll
Resource
win7-20240704-en
Target
83dc8257abc94bc76ddbdf5e8bfc1b5d_JaffaCakes118
Size
72KB
MD5
83dc8257abc94bc76ddbdf5e8bfc1b5d
SHA1
31b004a33705d4c55957a1674189ca1232e73d8d
SHA256
d2a111d732b861023468543979785bd1d04df4f4bbac1ba6e19faff3e24b5e02
SHA512
aaeb8542d8058feccec2bc4832e0e8bb4e5b59cb6ac98e089f92d2d3773aa04f2e3e7a424b581bc842a14f2b261953b754f67de8d1d8d9b864774d176073e674
SSDEEP
1536:87NjaVT4FvmgkrwdmwVo0POlU2wlKu9x:WNjaVmm9u9x
Checks for missing Authenticode signature.
resource |
---|
83dc8257abc94bc76ddbdf5e8bfc1b5d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
FindNextFileA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
RemoveDirectoryA
LocalFree
InterlockedIncrement
GetProcAddress
LoadLibraryA
GetCurrentProcessId
Sleep
MoveFileA
ExitProcess
GetCommandLineW
WritePrivateProfileStringA
Process32Next
Process32First
FreeLibrary
CreateThread
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strrchr
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
strncmp
strchr
strncpy
_wcslwr
wcsstr
fopen
fseek
ftell
memset
sprintf
??3@YAXPAX@Z
memcmp
memcpy
strstr
_purecall
??2@YAPAXI@Z
strlen
strcmp
_stricmp
_access
strcat
strcpy
fclose
fread
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ