DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ad8319fbe3a0265dc57c2abd84fa3237_JaffaCakes118.dll
Resource
win7-20240729-en
Target
ad8319fbe3a0265dc57c2abd84fa3237_JaffaCakes118
Size
56KB
MD5
ad8319fbe3a0265dc57c2abd84fa3237
SHA1
ab99b5d87c4ab6b2a064fe5f4c5e6de598213d71
SHA256
46b7d06fa8b8cb30502e990627311a96671d72e97194c9bd81c55180a3a30223
SHA512
df55440e3737c0883c88eb126c6997772091512168d3f4cdcf40f12149c533ca88b0c1cfbbf627239e6981253ea2afe2c4d8df701862ae9dc90fc972f8e30701
SSDEEP
768:9IOCFWmEvZqRyo2iBWsp2TGgyDPLoyoyV2XfuSo3XZn3Z1OkwzDGHxoamPaC1:ydFPeARyUjgyDPLh2XfvslRQGRopPa
Checks for missing Authenticode signature.
resource |
---|
ad8319fbe3a0265dc57c2abd84fa3237_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
Sleep
MoveFileA
SetFileAttributesA
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
Process32Next
Process32First
GetExitCodeProcess
CreateDirectoryA
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
WritePrivateProfileStringA
ExitProcess
CreateThread
LocalFree
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
LoadLibraryA
FreeLibrary
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
fread
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_purecall
_access
_wcslwr
wcsstr
strcpy
strcmp
strlen
sprintf
memcmp
memcpy
??3@YAXPAX@Z
atoi
strchr
strstr
strrchr
memset
fclose
_strupr
??2@YAPAXI@Z
ftell
fseek
fopen
strcat
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ