DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
b8715f615463ba19b3d86e39ce91d008_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b8715f615463ba19b3d86e39ce91d008_JaffaCakes118
Size
64KB
MD5
b8715f615463ba19b3d86e39ce91d008
SHA1
23c5d244ecc412ba1a813f54b7b5222805b5e663
SHA256
413a0a81e051353dfaed6a7985a5ba98ba146f70f0862922d592d4e7c2bc8117
SHA512
82a212ebce6293a8905e073602c283a58597dd5b8ba6a69740b58724b5a6379621c73387b0fa3d8d3d810d54595c6b9e9b7add46cea6e15a0ca532f24f21274e
SSDEEP
1536:NFuJlC27dZM75xYRYmP4sIG0rp+xaBCVm:NFuLC2HI6Y1sIexuCV
Checks for missing Authenticode signature.
resource |
---|
b8715f615463ba19b3d86e39ce91d008_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenA
GetShortPathNameA
Process32First
CreateProcessA
RemoveDirectoryA
CreateDirectoryA
CreateThread
GetCommandLineW
WritePrivateProfileStringA
GetSystemDirectoryA
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
Process32Next
CloseHandle
GetModuleFileNameA
Sleep
lstrlenW
WideCharToMultiByte
ExitProcess
GetProcAddress
LocalFree
LoadLibraryA
FreeLibrary
MultiByteToWideChar
SetFileAttributesA
MoveFileA
DeleteFileA
GetModuleHandleA
RegQueryValueExA
RegSetValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memcpy
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_wcslwr
wcsstr
strcmp
atoi
sprintf
strlen
strstr
??3@YAXPAX@Z
strncpy
strchr
memset
strncmp
strcpy
strrchr
_strupr
_purecall
??2@YAPAXI@Z
memcmp
strcat
_access
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ