DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
8b52ba4d992f96678fab4e385a0e32b4_JaffaCakes118.dll
Resource
win7-20240705-en
Target
8b52ba4d992f96678fab4e385a0e32b4_JaffaCakes118
Size
56KB
MD5
8b52ba4d992f96678fab4e385a0e32b4
SHA1
ab4882edb56a55a0476b8d3a844c1962463a8904
SHA256
17c87a9ee78937ca63e344ccc653973a527ec741bd979da3f3ecb546ee92242d
SHA512
3e76382f8130888f693bd8dffca99028f5da8a9e2060f4bb98bb88aca64f38f2ff9b17293c02eacef5510b2a3aad1a6be97bcefe830829a949301d8bcba6b55c
SSDEEP
768:aAnuA0ZChvMmWtIFHGhjcApxhrZPtPbKfKz94PRb8fZFVCRQqzRwHsbOoWtO:azRZmmIw7pfrZ92g4JupcRdbCtO
Checks for missing Authenticode signature.
resource |
---|
8b52ba4d992f96678fab4e385a0e32b4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetCurrentProcessId
MoveFileA
CreateThread
Sleep
CreateDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
GetExitCodeProcess
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
WritePrivateProfileStringA
GetCommandLineW
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
FreeLibrary
ExitProcess
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
LoadLibraryA
GetProcAddress
SetFileAttributesA
LocalFree
InterlockedIncrement
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strchr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
_purecall
memcpy
_access
fopen
fseek
??3@YAXPAX@Z
strstr
strrchr
sprintf
memset
strcat
memcmp
strlen
strcpy
atoi
_strupr
??2@YAPAXI@Z
strcmp
fclose
fread
ftell
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ