DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
965e2df66e8b823f46e3109d5fc30d86_JaffaCakes118.dll
Resource
win7-20240708-en
Target
965e2df66e8b823f46e3109d5fc30d86_JaffaCakes118
Size
76KB
MD5
965e2df66e8b823f46e3109d5fc30d86
SHA1
031f8231f282deaadfff3836130c557292e8bb31
SHA256
ecf1dc5dced76987b7b94e23664a734cbf60a608b23792ea216fd801daabfb2e
SHA512
344f166ef13502f44481cadb9d9fab3741c24e8e3c53730558babc4d0642bb387b5826cc31c245045cca5344c8028cb398ad25b5a802d9dc64e88cdca9b4ff9b
SSDEEP
1536:lHfNbGWkDs2Yg9+3481/x157CbF7kAdcfihlJVyO:rGWci07PcixVyO
Checks for missing Authenticode signature.
resource |
---|
965e2df66e8b823f46e3109d5fc30d86_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
lstrlenW
GetModuleFileNameA
WritePrivateProfileStringA
LocalFree
Sleep
CreateThread
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
ExitProcess
GetExitCodeProcess
WaitForSingleObject
CreateDirectoryA
GetCommandLineW
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
GetProcAddress
Process32First
Process32Next
LoadLibraryA
FreeLibrary
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
CloseHandle
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strchr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_purecall
memcpy
fopen
fseek
ftell
fread
fclose
??3@YAXPAX@Z
sprintf
strlen
memset
strcat
strcpy
strstr
strrchr
memcmp
atoi
_strupr
??2@YAPAXI@Z
strncpy
strncmp
_access
strcmp
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ