DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
94da3225ddbaa0cfcf84966b1a0780f1_JaffaCakes118.dll
Resource
win7-20240708-en
Target
94da3225ddbaa0cfcf84966b1a0780f1_JaffaCakes118
Size
52KB
MD5
94da3225ddbaa0cfcf84966b1a0780f1
SHA1
f6423448fde3bc90543106ef86fe9f6ba113450e
SHA256
d948d36485f544e92369437ef85eec830650c93a5fdfe205abdabb70e338fee3
SHA512
7fc3f0db092ffce199bbe360e7d24d76d34b14a22fdc4dd859b54a54d0b827d0423ddf675b1dc6dc68a68a6d40a49f5d2a376d8a036b56ddaac42f44fe3b6fa4
SSDEEP
1536:qssFWKt1HN4+tgptTEakLov/C9fHkYI/3+dD9ZPcGON:qHtA9ptTYL2KFjdD9ZPWN
Checks for missing Authenticode signature.
resource |
---|
94da3225ddbaa0cfcf84966b1a0780f1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32Next
Process32First
FreeLibrary
GetCommandLineW
RemoveDirectoryA
WideCharToMultiByte
lstrlenW
Sleep
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
CreateThread
InterlockedDecrement
HeapDestroy
lstrlenA
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
GetCurrentProcessId
WritePrivateProfileStringA
ExitProcess
LocalFree
MultiByteToWideChar
MoveFileA
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
GetExitCodeProcess
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetProcAddress
LoadLibraryA
EnterCriticalSection
RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
fclose
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
strncmp
strchr
strncpy
strcmp
memcmp
_purecall
memcpy
_access
??3@YAXPAX@Z
strstr
strrchr
sprintf
memset
strcat
strlen
wcsstr
_wcslwr
strcpy
_strupr
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ