DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
887d78874135c13cf173ca22caaf0245_JaffaCakes118.dll
Resource
win7-20240729-en
Target
887d78874135c13cf173ca22caaf0245_JaffaCakes118
Size
64KB
MD5
887d78874135c13cf173ca22caaf0245
SHA1
a04de10cfa9d53fa75619d1d97954dc493fb5a20
SHA256
45e9cb1e1d37993ee99242924b6648d35f596f6ef5d127f8f589bf77b6849464
SHA512
8f035afd8977dceca0d4ec955725d9055d945ff194fc5ca64468b3efd9c44b4c2df709c68c898b3c0d3fdb923f6ebb260876890a29bae1961b924dcec67ada64
SSDEEP
1536:iM2aaFvhB1kjas5Dhwu2LAe2TIeiArbR9mhj:lUl6qj2TvbR9Wj
Checks for missing Authenticode signature.
resource |
---|
887d78874135c13cf173ca22caaf0245_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FreeLibrary
lstrlenA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CreateDirectoryA
LeaveCriticalSection
EnterCriticalSection
Sleep
ExitProcess
GetCurrentProcessId
GetSystemDirectoryA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
RemoveDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
CreateThread
WritePrivateProfileStringA
GetCommandLineW
LoadLibraryA
GetProcAddress
lstrlenW
WideCharToMultiByte
LocalFree
MultiByteToWideChar
SetFileAttributesA
MoveFileA
DeleteFileA
DisableThreadLibraryCalls
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strncpy
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
fopen
fseek
ftell
fread
fclose
_purecall
memcpy
strcmp
sprintf
strlen
??3@YAXPAX@Z
strstr
memset
memcmp
strcat
strcpy
strrchr
_access
_strupr
strchr
strncmp
??2@YAPAXI@Z
wcsstr
_wcslwr
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ