DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a58df3a64807d3e97c12b8c709be31a4_JaffaCakes118.dll
Resource
win7-20240708-en
Target
a58df3a64807d3e97c12b8c709be31a4_JaffaCakes118
Size
60KB
MD5
a58df3a64807d3e97c12b8c709be31a4
SHA1
e60026d3d0fffe86e250c81618d65c5397cbcb96
SHA256
1c577997d759478d80f542061d851c8a9794deef3c18c66a242ecca47d96d70f
SHA512
81811342a527031225af35df6e2d06af389a1444f31fcbdb08102f91bf97ba18a7dd5189dabb19892619b68377e5d9f5dfcb712e7e82792262199b1b3929e1c3
SSDEEP
1536:lDnULK1FFhfwUpCbf+7gdSfxgxjQDhCQVbi3ZVbu:dfw13Sfxg2iJVbu
Checks for missing Authenticode signature.
resource |
---|
a58df3a64807d3e97c12b8c709be31a4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCommandLineW
WritePrivateProfileStringA
Sleep
MoveFileA
MultiByteToWideChar
LocalFree
FreeLibrary
lstrlenA
WideCharToMultiByte
lstrlenW
DisableThreadLibraryCalls
LoadLibraryA
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
ExitProcess
CreateDirectoryA
GetCurrentProcessId
GetProcAddress
SetFileAttributesA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CreateThread
EnterCriticalSection
LeaveCriticalSection
Process32First
Process32Next
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
CloseHandle
InitializeCriticalSection
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegQueryValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
SysFreeString
SysAllocString
LoadRegTypeLi
VariantClear
SysStringLen
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
strrchr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
_access
fopen
fseek
ftell
fread
fclose
strncmp
strncpy
??2@YAPAXI@Z
_purecall
memcpy
strlen
memset
strcat
strcpy
sprintf
strstr
_strupr
??3@YAXPAX@Z
atoi
strchr
strcmp
memcmp
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ