DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
b3a4f2abb9eba8ef1566bb3f969cd2ca_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b3a4f2abb9eba8ef1566bb3f969cd2ca_JaffaCakes118
Size
64KB
MD5
b3a4f2abb9eba8ef1566bb3f969cd2ca
SHA1
9e30bfb468e9a9b6cf541480eebafdae0086104e
SHA256
62db3ccccf060750ba8fa98815cf0f35c0920c0ab35424b274a6baf2de59a7c8
SHA512
b87ba1a5833e510260b99edbb3a30a4ff0f8b48926874d1d954d3f4aaa45baa087b3f667170e34fb39d40de9a847f8431b8d031e388b2b012c44c8f8a9958793
SSDEEP
1536:B/gl+tAfPW0bFQ547ypFCw0EC108M0jTD+b/BJ1:Cl6ce0bFQq7yvfbCNnr+b/Bj
Checks for missing Authenticode signature.
resource |
---|
b3a4f2abb9eba8ef1566bb3f969cd2ca_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
Sleep
MoveFileA
SetFileAttributesA
WideCharToMultiByte
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
GetCurrentProcessId
WritePrivateProfileStringA
Process32First
Process32Next
CloseHandle
ExitProcess
GetProcAddress
CreateDirectoryA
RemoveDirectoryA
CreateProcessA
CreateThread
GetModuleFileNameA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetCommandLineW
FreeLibrary
LoadLibraryA
GetModuleHandleA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
fread
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
atoi
memcmp
_purecall
memcpy
strlen
strncmp
strchr
strstr
strrchr
sprintf
strcmp
??3@YAXPAX@Z
strcat
strcpy
memset
_access
fclose
_strupr
??2@YAPAXI@Z
ftell
fseek
fopen
strncpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ