DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
886faefb13db47b4bbe892e203104358_JaffaCakes118.dll
Resource
win7-20240704-en
Target
886faefb13db47b4bbe892e203104358_JaffaCakes118
Size
60KB
MD5
886faefb13db47b4bbe892e203104358
SHA1
a03bb225bd2d41aefa0c6e84a1ec13c5f27fe8a7
SHA256
ca606ea5aae994d27f10a25f0fbea8b4a89e951d9f857270bcd80a715c282119
SHA512
13ac2dec78c7a04ce72321704c2ef847acaa4ee0c6709a705c7b401a85414273a0cf34b1f8cd56562ea43036b03dc2a2edf689d0ab7fb3f1d857d4b76a1486d4
SSDEEP
1536:OXEmwH4qZr/ipdkwEvn0jYAoB1aKGSYnAFX:pNr2pdkwEvgYAo+DSYAF
Checks for missing Authenticode signature.
resource |
---|
886faefb13db47b4bbe892e203104358_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindFirstFileA
SetFileAttributesA
GetCommandLineW
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
CreateThread
MoveFileA
Process32Next
Process32First
WritePrivateProfileStringA
GetPrivateProfileStringA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Sleep
RemoveDirectoryA
ExitProcess
DeleteFileA
FindNextFileA
LocalFree
GetCurrentProcessId
CreateDirectoryA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strchr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
??2@YAPAXI@Z
_purecall
memcmp
??3@YAXPAX@Z
_access
strcat
memset
strlen
strstr
strrchr
sprintf
atoi
_strupr
strcpy
strcmp
wcsstr
_wcslwr
memcpy
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ