DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
96e0e8b1ea0796d1d7064b6e1d5a1e52_JaffaCakes118.dll
Resource
win7-20240705-en
Target
96e0e8b1ea0796d1d7064b6e1d5a1e52_JaffaCakes118
Size
64KB
MD5
96e0e8b1ea0796d1d7064b6e1d5a1e52
SHA1
63a83d68eeec5ec90ce88f50494b085a2eaf34dd
SHA256
ffd9df0bc274ec336ba2cfa380dadca46d27132e3a6ace96654da59842d5ec58
SHA512
07af3f8492cde5ae4e2a8307e8589154594034e0756341787865d2fbbed7e869b584c9bf6e239db5ba87caafd3eb8f2667c99a69ae827333d0de1a364a9d7ead
SSDEEP
768:axUbI92gzLeEnv3fZmB6KR2JK48s5rW0/6FdRkMXKS8i1JS58nZdltqMQyuKJtMr:Sv9PH3JrJKpUrmFd1XK01JS5kSYu/xB
Checks for missing Authenticode signature.
resource |
---|
96e0e8b1ea0796d1d7064b6e1d5a1e52_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetProcAddress
CreateThread
WideCharToMultiByte
LocalFree
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
InterlockedDecrement
WritePrivateProfileStringA
GetSystemDirectoryA
MoveFileA
GetCurrentProcessId
ExitProcess
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
Process32First
Process32Next
CreateDirectoryA
RemoveDirectoryA
CreateProcessA
CloseHandle
GetModuleFileNameA
DeleteFileA
Sleep
FreeLibrary
LoadLibraryA
FindFirstFileA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
_wcslwr
wcsstr
memcmp
_purecall
memcpy
strstr
_access
strcmp
??3@YAXPAX@Z
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
fclose
fread
_strupr
ftell
fseek
fopen
strcat
strrchr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ