DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ae20b8f6e4ae96c0de87b5bb8dd33f1d_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ae20b8f6e4ae96c0de87b5bb8dd33f1d_JaffaCakes118
Size
48KB
MD5
ae20b8f6e4ae96c0de87b5bb8dd33f1d
SHA1
0222266b01d7a1155fee9e1bc8a1a0e0740daa91
SHA256
a59fe5a103e53dcdeae2d0c4238f11a23aa9b6d4b66c7f6536ae258f9a84594e
SHA512
52080359670699994f8a55f88e183a8be8b6fd6cc087e3cdd0078093e709602bd8074d48b95a6d4bcc4aa0358a406f2b6b3c6aa3097efea4cd696564d0b00b8d
SSDEEP
768:iurUIrfOvzmmMJVbHZ5Py5qaNIf25AzVJCHKV/S4ls1Z+uyer4f79Yn9KHsOwBvc:iurhfOvzqJBL4If20VJCHKVaoZper4Du
Checks for missing Authenticode signature.
resource |
---|
ae20b8f6e4ae96c0de87b5bb8dd33f1d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
FreeLibrary
LoadLibraryA
LocalFree
CreateDirectoryA
GetCurrentProcessId
WideCharToMultiByte
GetProcAddress
lstrlenW
MoveFileA
Sleep
CreateProcessA
RemoveDirectoryA
CreateThread
WritePrivateProfileStringA
ExitProcess
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
Process32First
Process32Next
GetModuleFileNameA
CloseHandle
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
FindNextFileA
DeleteFileA
GetCommandLineW
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
??3@YAXPAX@Z
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strncmp
strncpy
_wcslwr
wcsstr
strstr
sprintf
memset
strrchr
strcat
strlen
strcpy
strcmp
memcpy
_purecall
_stricmp
??2@YAPAXI@Z
memcmp
_access
atoi
strchr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ