DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ba5b43ffc7551ce775878ed4f81323e0_JaffaCakes118.dll
Resource
win7-20240704-en
Target
ba5b43ffc7551ce775878ed4f81323e0_JaffaCakes118
Size
64KB
MD5
ba5b43ffc7551ce775878ed4f81323e0
SHA1
4b0c18955b797e0504165fc876486476bd25c423
SHA256
16b5b3f3c35a5cba86bc634ff1a44395b2e6fb8761b91749453c4d128da06944
SHA512
44d5785dee6dc25721587b52b9cb0a9ff5e9243641692285f6821bcb5a3ee53c18ae43561b6c2e7935da635d486b51e4f3f8a63077297c1693d0d4dbdd068f7a
SSDEEP
1536:0RaKlu+VxC9G8Wq6ZT3Z8s1QnUXwxeD4BtlOOLlRW2M4:03ugZT3nQa4UqRW2M4
Checks for missing Authenticode signature.
resource |
---|
ba5b43ffc7551ce775878ed4f81323e0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
FindNextFileA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
lstrlenA
WideCharToMultiByte
GetCurrentProcessId
FreeLibrary
LocalFree
CreateThread
GetCommandLineW
MoveFileA
ExitProcess
CreateDirectoryA
Sleep
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
WritePrivateProfileStringA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
GetProcAddress
LoadLibraryA
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strcat
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strchr
atoi
strcmp
strlen
_wcslwr
wcsstr
fopen
??3@YAXPAX@Z
strstr
memset
sprintf
memcpy
_purecall
??2@YAPAXI@Z
memcmp
strcpy
strrchr
_strupr
_access
fclose
fread
ftell
fseek
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ