DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a59d32989c99a63116987f0dd05beaac_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a59d32989c99a63116987f0dd05beaac_JaffaCakes118
Size
48KB
MD5
a59d32989c99a63116987f0dd05beaac
SHA1
2647e57b6383b97b1340f0ccde3aa29014851b0d
SHA256
0b64d11e5a337eab2dcaf2ecdc82c40aa731871906d108a5cb59c4c61e012809
SHA512
c5d803015f9f12c9534dcac2791ae39c2e905b56a0597fc6be524e069a3793aaa2e6fc8dda16a60be341479e7303122bf988374a4e3b06f72f5e91f55c157491
SSDEEP
768:n4ejteaGSPJj8dAaPZHFr1HVsDD5C4JA74+Sgg4OYzlU1iInsBWAO7:nbjUahhsntYjJU4+Fg4HzlnInsBW
Checks for missing Authenticode signature.
resource |
---|
a59d32989c99a63116987f0dd05beaac_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindFirstFileA
ExitProcess
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
GetPrivateProfileStringA
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
RemoveDirectoryA
CreateThread
WritePrivateProfileStringA
GetProcAddress
GetCommandLineW
MoveFileA
CreateDirectoryA
FindNextFileA
DeleteFileA
lstrlenA
MultiByteToWideChar
SetFileAttributesA
GetModuleFileNameA
LoadLibraryA
FreeLibrary
GetCurrentProcessId
LocalFree
CloseHandle
WideCharToMultiByte
lstrlenW
InterlockedIncrement
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
strchr
atoi
_access
_purecall
_wcslwr
wcsstr
strlen
??3@YAXPAX@Z
memset
strcat
strcpy
sprintf
memcmp
memcpy
fclose
fread
_strupr
ftell
fseek
fopen
strrchr
strstr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ