DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
960da18178b70b6587dec89ba8aae2f3_JaffaCakes118.dll
Resource
win7-20240708-en
Target
960da18178b70b6587dec89ba8aae2f3_JaffaCakes118
Size
52KB
MD5
960da18178b70b6587dec89ba8aae2f3
SHA1
84d3291483e991d156281f57626652d99c6bad63
SHA256
2c289a7efc7dc74f5b6338bf49334bc81290faa28c6ada5860adb3b216bb82d5
SHA512
e9b31f95bf24ba79ca26cb36e109ecf7295994732798beb34db026f65f6f8ec5fd88344de0acf4b8ae092b7ebe71a20eaa782aa1e60480635e88a18718a3be3a
SSDEEP
1536:/dmk0MBx8AorPWj+wdv0UK6gSin7b1TgGBHO:/n0MkPw+eFZin7BTj
Checks for missing Authenticode signature.
resource |
---|
960da18178b70b6587dec89ba8aae2f3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
GetSystemDirectoryA
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
lstrlenA
WritePrivateProfileStringA
ExitProcess
GetProcAddress
GetCurrentProcessId
CreateProcessA
MoveFileA
RemoveDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
WaitForSingleObject
CloseHandle
GetExitCodeProcess
lstrlenW
WideCharToMultiByte
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
CreateThread
Sleep
LocalFree
FreeLibrary
LoadLibraryA
CreateDirectoryA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
_wcslwr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
fopen
fseek
ftell
fread
fclose
_access
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
strstr
wcsstr
_strupr
strrchr
strcat
strcmp
atoi
memcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ