DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
96907e16cf6c02e1c0ffa9c13ce61022_JaffaCakes118.dll
Resource
win7-20240704-en
Target
96907e16cf6c02e1c0ffa9c13ce61022_JaffaCakes118
Size
52KB
MD5
96907e16cf6c02e1c0ffa9c13ce61022
SHA1
d902999e6b27d8dc823863397f769c8f26b65213
SHA256
e81218cb3809fd087737c03e7727c44f89a6e29681cbfdfafa705dec659a750c
SHA512
0be997ff2eed3734905d5285e2ee77378406ef2814c04411f50845fd0a9c766225b96183906b1dfc25f1be24e537ff3e19338daaa90facf29f549d0fc8832b9b
SSDEEP
1536:ICOeCrBoNid9WDhQXdlWfqs72oHgq1U0F4H:ICO+7fh2oHgMF
Checks for missing Authenticode signature.
resource |
---|
96907e16cf6c02e1c0ffa9c13ce61022_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
WritePrivateProfileStringA
MoveFileA
DeleteFileA
WideCharToMultiByte
CreateDirectoryA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
Sleep
GetExitCodeProcess
CreateProcessA
GetProcAddress
LoadLibraryA
GetCurrentProcessId
FreeLibrary
ExitProcess
GetCommandLineW
CreateThread
Process32Next
Process32First
RemoveDirectoryA
CloseHandle
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LocalFree
SetFileAttributesA
WaitForSingleObject
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
_access
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
strcmp
fopen
fseek
ftell
fread
??3@YAXPAX@Z
atoi
strchr
memcpy
_purecall
??2@YAPAXI@Z
memcmp
sprintf
memset
strlen
_strupr
strcat
strstr
strrchr
strcpy
fclose
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ