DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a18405d6e78d8179c9d14b7d7a487481_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a18405d6e78d8179c9d14b7d7a487481_JaffaCakes118
Size
52KB
MD5
a18405d6e78d8179c9d14b7d7a487481
SHA1
b23cc46035f069d20f772e0af27e6c6314a98c8a
SHA256
3d2efec58c97ca8350bb08d076e7085166903c3336d4ea264734e7d850b528f6
SHA512
3a4dab4388803a6fb1059b99aef9d4dc53687e639d20120b7de92a1285be741a7007d45b99a0703e1d9854444570ab26d13cb867fb687b80f5bcfa2d59f34392
SSDEEP
1536:zAHaJVGZzVcUfEJ7YqXXs8/YBFU2z74VTnJ:z1GSJZYB2K7YJ
Checks for missing Authenticode signature.
resource |
---|
a18405d6e78d8179c9d14b7d7a487481_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
MultiByteToWideChar
WritePrivateProfileStringA
Process32Next
Process32First
Sleep
GetCommandLineW
FindNextFileA
DeleteFileA
GetPrivateProfileStringA
FindFirstFileA
RemoveDirectoryA
CreateThread
MoveFileA
FreeLibrary
GetCurrentProcessId
lstrlenW
WideCharToMultiByte
SetFileAttributesA
LocalFree
WaitForSingleObject
GetExitCodeProcess
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
CreateProcessA
ExitProcess
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
memcmp
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
atoi
strncmp
strchr
strncpy
memset
sprintf
strlen
strcat
strcpy
??3@YAXPAX@Z
strcmp
strrchr
strstr
??2@YAPAXI@Z
_strlwr
wcsstr
_wcslwr
memcpy
_purecall
_access
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ