DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
a9a44c95223afc29331645c249f237af_JaffaCakes118.dll
Resource
win7-20240704-en
Target
a9a44c95223afc29331645c249f237af_JaffaCakes118
Size
68KB
MD5
a9a44c95223afc29331645c249f237af
SHA1
6e483527d0b658730f2e6e1ea023f33c3e51a26c
SHA256
cf2e7fcb673334144d7120ce9acb869b6acc27d26970c7ad0c27161d298e7c8b
SHA512
759c88562b74fdc056768e683f28c00620c88979d83ed2084a457bbb3e2361b123b2bf4ceef93537493d6083e5130769a22087753e9c18afc08f866bd8a35bb7
SSDEEP
768:a814M4Xrpu+nQkEEZ40zb4NW3DzoA9dYf1TTjZ7Lih/mAm/X9atLsbZCu+wPU1s:a8iXg+zm0H4IDzINxum//XYIZCu+H1s
Checks for missing Authenticode signature.
resource |
---|
a9a44c95223afc29331645c249f237af_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
LocalFree
SetFileAttributesA
CreateProcessA
GetSystemDirectoryA
GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
Process32Next
Process32First
MoveFileA
ExitProcess
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
GetCurrentProcessId
Sleep
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
CloseHandle
DeleteFileA
CreateDirectoryA
CreateThread
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CommandLineToArgvW
SHGetSpecialFolderPathA
CoUninitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoInitialize
CoMarshalInterThreadInterfaceInStream
SysFreeString
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
fseek
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
_wcslwr
wcsstr
strncmp
strncpy
strcmp
memcmp
strcpy
strlen
_access
strchr
atoi
??3@YAXPAX@Z
fclose
fread
memset
??2@YAPAXI@Z
ftell
_strupr
fopen
strcat
strrchr
sprintf
strstr
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ