DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
8d3657b1dc9a3d7bb8fcfcdcd6750590_JaffaCakes118.dll
Resource
win7-20240704-en
Target
8d3657b1dc9a3d7bb8fcfcdcd6750590_JaffaCakes118
Size
52KB
MD5
8d3657b1dc9a3d7bb8fcfcdcd6750590
SHA1
dd029731b1659147af3f6154576bc58ed3baca2d
SHA256
c9e0f2c71c61276f6a4c5333faec2481f3dbb53b702369c2041cef4fd369d6ad
SHA512
3ffc6cdb4099202a56dfb9d3c0002c259f6362012cb600df4d52a278d5797191265f06adf70eef3ced562391238e07535e834600c6cce706794d2461f8798809
SSDEEP
1536:AkHMkhsd2Ax90rJk8UFeImjHCJ8fcqnG1m:8kha8isIqnGI
Checks for missing Authenticode signature.
resource |
---|
8d3657b1dc9a3d7bb8fcfcdcd6750590_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
ExitProcess
MultiByteToWideChar
lstrlenA
MoveFileA
LeaveCriticalSection
EnterCriticalSection
CreateProcessA
RemoveDirectoryA
LoadLibraryA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateThread
CreateDirectoryA
GetSystemDirectoryA
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
GetCommandLineW
GetModuleFileNameA
SetFileAttributesA
LocalFree
lstrlenW
WideCharToMultiByte
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
Sleep
GetCurrentProcessId
Process32First
Process32Next
WritePrivateProfileStringA
CloseHandle
DisableThreadLibraryCalls
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegEnumKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcat
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
strcmp
_wcslwr
wcsstr
_access
atoi
fopen
fseek
sprintf
strstr
strcpy
strncpy
strchr
memset
strncmp
strlen
strrchr
??3@YAXPAX@Z
_strupr
memcmp
fclose
fread
??2@YAPAXI@Z
ftell
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ