DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
b2f4a0ccdc8fca8c8251a123277facfd_JaffaCakes118.dll
Resource
win7-20240705-en
Target
b2f4a0ccdc8fca8c8251a123277facfd_JaffaCakes118
Size
64KB
MD5
b2f4a0ccdc8fca8c8251a123277facfd
SHA1
aef030d0d9e8e6703cc54687b3685cab5678f3da
SHA256
82f4526880fdc02725ef68812761ba24ac42cf081c5f3789be2ff69bd3bc68e7
SHA512
68a54c48df769f23fa8c2d0c03a1d4a7e7f69a8a9d5d15512a06d3f28b8c445d7d73b2d9abbc7b2b73f58108118cb33600e6923cbe978be91eec71857cc58cab
SSDEEP
1536:zR8Vh2zxR/CuoymqcfWMETNfbVFi3kf/l:9Qh2zsIMqfm3kX
Checks for missing Authenticode signature.
resource |
---|
b2f4a0ccdc8fca8c8251a123277facfd_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
ExitProcess
CloseHandle
GetSystemDirectoryA
LocalFree
InitializeCriticalSection
Process32Next
Process32First
SetFileAttributesA
WritePrivateProfileStringA
FreeLibrary
LoadLibraryA
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
GetProcAddress
CreateThread
MoveFileA
DisableThreadLibraryCalls
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
Sleep
GetCommandLineW
GetCurrentProcessId
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
DeleteFileA
CreateProcessA
RemoveDirectoryA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strstr
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strcmp
_wcslwr
wcsstr
strlen
fopen
fseek
ftell
atoi
strchr
strcat
strcpy
memset
sprintf
_access
memcmp
memcpy
??3@YAXPAX@Z
_strupr
strrchr
_purecall
??2@YAPAXI@Z
fclose
fread
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ