DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
8d606adc203c302c5f52c0447e9eefda_JaffaCakes118.dll
Resource
win7-20240705-en
Target
8d606adc203c302c5f52c0447e9eefda_JaffaCakes118
Size
52KB
MD5
8d606adc203c302c5f52c0447e9eefda
SHA1
16afb215d3cda82769f27c55cae019f899fd5a4d
SHA256
eaf5348a0c9cf42cd01f8b226ca1478ffb978d4e4baf2b8e233bd1488722b5ca
SHA512
83a6ef41ed72ea7744e9e424a261a4f620c1d74a1c99e2b50ded42aa55089d25aedea42666308366cb9eeae59a2e811c5c90d1a33ef54bf663498fba4789752d
SSDEEP
768:UsED/JnKZCUU7V38EBnNgeyc1Pj+3fcJEOZmw5/c1me/ZYGkxYyWlRrpbhdQT/cY:xE7T7Vn0ezPj+3w35kLdbymlherA6
Checks for missing Authenticode signature.
resource |
---|
8d606adc203c302c5f52c0447e9eefda_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCommandLineW
FindNextFileA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
CreateThread
LeaveCriticalSection
EnterCriticalSection
ExitProcess
MoveFileA
LocalFree
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Sleep
CreateDirectoryA
RemoveDirectoryA
WaitForSingleObject
GetExitCodeProcess
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
Process32First
Process32Next
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
WideCharToMultiByte
lstrlenW
WritePrivateProfileStringA
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
wcsstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_access
strcmp
strchr
atoi
_purecall
memcpy
fopen
strlen
??3@YAXPAX@Z
memset
sprintf
strcpy
memcmp
strstr
strrchr
strcat
??2@YAPAXI@Z
_strupr
_wcslwr
fclose
fread
ftell
fseek
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ