DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a7ca4a8da21b9009dfe15e038ed674f3_JaffaCakes118.dll
Resource
win7-20240705-en
Target
a7ca4a8da21b9009dfe15e038ed674f3_JaffaCakes118
Size
80KB
MD5
a7ca4a8da21b9009dfe15e038ed674f3
SHA1
69b9e5355c0eb9b21a61bb7ff5e8b73cfe6abd70
SHA256
d7343bcfc4e8e7b66b1c6e0f8dd64f3758219eb23c8424a28a82ea9a53565e8e
SHA512
526bb7efb985731745a385bb1b4e0e5a3a3f398abcaa62dbb4b194e089149c3cb85b2b934e6106ac648dac812be10b15929c5b09555dc423b2715470ee0d6a67
SSDEEP
768:LOoTHsohJGCS1XQeo/EKjcpMQHgJz+iL7dDZ4BrRWQK3QA5xP56iM1NGRuzqBK:bbSV8/EKjagJzx2c3QA5L6iMSRuOK
Checks for missing Authenticode signature.
resource |
---|
a7ca4a8da21b9009dfe15e038ed674f3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
GetCurrentProcessId
CreateDirectoryA
Sleep
LocalFree
lstrlenA
Process32Next
Process32First
RemoveDirectoryA
GetProcAddress
DisableThreadLibraryCalls
FindFirstFileA
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
lstrlenW
GetShortPathNameA
GetModuleHandleA
WideCharToMultiByte
GetCommandLineW
CreateThread
GetPrivateProfileStringA
FindNextFileA
WaitForSingleObject
GetExitCodeProcess
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
SetFileAttributesA
MoveFileA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
LoadLibraryA
FreeLibrary
DeleteFileA
ExitProcess
InitializeCriticalSection
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize
SysFreeString
VariantClear
SysAllocString
LoadRegTypeLi
SysStringLen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
fseek
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
memcmp
_purecall
memcpy
atoi
strncmp
strchr
strncpy
strcmp
strcpy
_access
strlen
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
_strupr
fopen
strcat
strrchr
sprintf
strstr
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ