DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
b7494e88905da6d874804dadeffb3f40_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b7494e88905da6d874804dadeffb3f40_JaffaCakes118
Size
60KB
MD5
b7494e88905da6d874804dadeffb3f40
SHA1
3e8d15c06d687fa80530b60a127c182310975065
SHA256
abe34b14a6849fa87f2314a9133b427dff1794ee528535611bac2953750c37f1
SHA512
5310ba8aeff77bf2c19c9a9e0b6177748cdb0fdbcb0e4e41b3bf3e8c3062994045733012b83347b2c1466f8cd5f06c6e758551c2dc7bd39967e161b684c888c9
SSDEEP
768:jcDPZ+6C9q22j0nGeYFNqaPa0RkPs3auRoxKKJvd2/8oWViLX9iMeFKDon/TQTfr:jkLfl4nGPBaMLRRsx/2EzUtNGVn/kTS
Checks for missing Authenticode signature.
resource |
---|
b7494e88905da6d874804dadeffb3f40_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
CreateProcessA
RemoveDirectoryA
GetCurrentProcessId
GetProcAddress
LoadLibraryA
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
CreateThread
GetExitCodeProcess
CloseHandle
Sleep
GetSystemDirectoryA
Process32Next
Process32First
ExitProcess
CreateDirectoryA
FreeLibrary
LocalFree
MoveFileA
GetCommandLineW
WideCharToMultiByte
DeleteFileA
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
WaitForSingleObject
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoUninitialize
SysFreeString
LoadRegTypeLi
SysStringLen
VariantClear
SysAllocString
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
fclose
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
_wcslwr
wcsstr
_access
strcpy
strncmp
strchr
strncpy
strstr
strlen
strrchr
strcat
sprintf
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
_strupr
fread
memset
ftell
fseek
fopen
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ