DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ba6dd1c6789b7214c0f3166df08bfd92_JaffaCakes118.dll
Resource
win7-20240729-en
Target
ba6dd1c6789b7214c0f3166df08bfd92_JaffaCakes118
Size
64KB
MD5
ba6dd1c6789b7214c0f3166df08bfd92
SHA1
1d4b8b9d4162e73e11e2b5a9827828f72c1c66cc
SHA256
cf6d7a395fb18faff9c0e8a30d518cc87ba0eef1d212a7b8a1cc42195e99faca
SHA512
cdb82a3cec565ba8e54ced1325730c1b055c284b365314b765ec205c0e0e65997fa95a09ccb333d015af4bbd5fcce2f88c4381b482274fab83f83613e475e031
SSDEEP
768:9odd7okh9Osjb4OtPXZ9Hy1FTARSxKVucPFRUNS4QTvZ6URnYjhgKY/f5rEPfQiv:idCkn4OLM2SOhPEwXvZRnYKKY/tEQ/3
Checks for missing Authenticode signature.
resource |
---|
ba6dd1c6789b7214c0f3166df08bfd92_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
DisableThreadLibraryCalls
GetCurrentProcessId
WideCharToMultiByte
MoveFileA
Sleep
WritePrivateProfileStringA
Process32Next
Process32First
ExitProcess
GetCommandLineW
RemoveDirectoryA
GetProcAddress
LocalFree
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CreateDirectoryA
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
LoadLibraryA
FreeLibrary
CloseHandle
CreateThread
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
SysFreeString
LoadRegTypeLi
SysStringLen
VariantClear
SysAllocString
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
strstr
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
strchr
atoi
memcmp
??2@YAPAXI@Z
_purecall
memcpy
strlen
memset
strcat
strcpy
sprintf
??3@YAXPAX@Z
_strlwr
strrchr
_access
wcsstr
_wcslwr
strcmp
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ