DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
b9984653bcb4ec34593ed9eafdc4f33b_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b9984653bcb4ec34593ed9eafdc4f33b_JaffaCakes118
Size
52KB
MD5
b9984653bcb4ec34593ed9eafdc4f33b
SHA1
f77fea28ec1f9c5d76cf11bc02a5cf103937ecc3
SHA256
316018265fd769cde707dce2bda5e9cb69d7060bb10d79e84812a35147f58036
SHA512
d696a2ae8bdda91755cedb8b42a54f45215cc285adc3b73390e97109aa02d7082a49f280784ca83dbd167963b68fc12497ff76e2a609f9b3acb226512dd120d1
SSDEEP
1536:tNz8T5VuGEpWGpidkaJwum7xldZY4SycL:tw5/EEk4w3x64SycL
Checks for missing Authenticode signature.
resource |
---|
b9984653bcb4ec34593ed9eafdc4f33b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenW
LocalFree
FreeLibrary
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
Sleep
Process32Next
Process32First
WideCharToMultiByte
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
LoadLibraryA
GetProcAddress
ExitProcess
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
GetModuleFileNameA
WritePrivateProfileStringA
GetCommandLineW
SetFileAttributesA
DeleteFileA
MoveFileA
EnterCriticalSection
LeaveCriticalSection
CloseHandle
MultiByteToWideChar
lstrlenA
CreateThread
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegCreateKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
fread
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
memcpy
atoi
strncmp
strchr
strncpy
_access
_wcslwr
wcsstr
sprintf
strstr
??3@YAXPAX@Z
strlen
memset
strcat
strcpy
strrchr
strcmp
fclose
_strlwr
??2@YAPAXI@Z
ftell
fseek
fopen
memcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ