DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
b678e2d25c37217e414081eeabd6ddc9_JaffaCakes118.dll
Resource
win7-20240705-en
Target
b678e2d25c37217e414081eeabd6ddc9_JaffaCakes118
Size
52KB
MD5
b678e2d25c37217e414081eeabd6ddc9
SHA1
2b81d9d5cf8f0f31680f890cb489715ce3dfd9b2
SHA256
63a95cffa040a7ddc0340829507413fce53956e6fef5b771979add0d7a5097c1
SHA512
2a1fe02d887e6e29570f186fb049314d60b2681a1b4bb528978c7d7cb7bcbaa67c7eb4acabdb6bce9363c5c6a724c2ef4839b7b30fe8ba87e9ef2a88d35babe7
SSDEEP
1536:tnkPQYYYJtDBFGGlLqM/bs9laSRFgvNwlKLxq:sQatDRl1yaBwlKk
Checks for missing Authenticode signature.
resource |
---|
b678e2d25c37217e414081eeabd6ddc9_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RemoveDirectoryA
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
CreateThread
MoveFileA
SetFileAttributesA
LocalFree
GetSystemDirectoryA
CreateProcessA
Sleep
GetExitCodeProcess
WaitForSingleObject
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
lstrlenA
MultiByteToWideChar
ExitProcess
GetModuleFileNameA
WritePrivateProfileStringA
GetCurrentProcessId
lstrlenW
WideCharToMultiByte
Process32First
Process32Next
CloseHandle
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetProcAddress
LoadLibraryA
FreeLibrary
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegEnumKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
GetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
ftell
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_purecall
_wcslwr
wcsstr
memcpy
memcmp
strcmp
strchr
??3@YAXPAX@Z
strstr
strrchr
sprintf
strcpy
strlen
fclose
fread
memset
??2@YAPAXI@Z
_strupr
fseek
fopen
strcat
_access
atoi
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ