DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
8724e5304695e7bb4473c77be54aabc2_JaffaCakes118.dll
Resource
win7-20240708-en
Target
8724e5304695e7bb4473c77be54aabc2_JaffaCakes118
Size
68KB
MD5
8724e5304695e7bb4473c77be54aabc2
SHA1
7dc2eb5a562e693a923f09daeb6aa02f03553206
SHA256
665e0c1ff7906a6c0554e43c51c6ef20f3b5055a511500a882db6dfca2fa69cb
SHA512
69373d0e0c3f4efed79035073478d5a633251b46ff60a5e8499ac81c2c028d1d7293495f23511c835a2ed4ce9202a3bd57446779cd4b9c0bcd89c4e9b3784492
SSDEEP
1536:DCNv42IuBRbvZGG9Qta9KCtcne66RH5Yj9nF:w41uvFGcQiie6W5Yhn
Checks for missing Authenticode signature.
resource |
---|
8724e5304695e7bb4473c77be54aabc2_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
FreeLibrary
WideCharToMultiByte
CreateProcessA
DeleteCriticalSection
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
MoveFileA
CreateThread
GetCurrentProcessId
CreateDirectoryA
Sleep
InitializeCriticalSection
DisableThreadLibraryCalls
SetFileAttributesA
Process32First
Process32Next
CloseHandle
ExitProcess
LocalFree
GetModuleFileNameA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetCommandLineW
WritePrivateProfileStringA
GetProcAddress
LoadLibraryA
RemoveDirectoryA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
fclose
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
_access
_wcslwr
wcsstr
memcmp
_purecall
memcpy
??3@YAXPAX@Z
sprintf
strstr
strrchr
memset
strlen
atoi
strchr
strcpy
strcat
_strupr
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ