DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
bcdfc8de4c8ebafbc8e21170854ee760_JaffaCakes118.dll
Resource
win7-20240705-en
Target
bcdfc8de4c8ebafbc8e21170854ee760_JaffaCakes118
Size
52KB
MD5
bcdfc8de4c8ebafbc8e21170854ee760
SHA1
9a940684f1d50bbb31d73380bc9e017e3ff86c1a
SHA256
adc808e7a0f07ad2ba59c1387bb0e1e6a5b0882decb87cdb99492b9b4bfebd6e
SHA512
da3b1aca9d1bd21fd89a59b2cd7e22ed6e3f9ba9976d83044859b8135185ae641c2ad0b96c825badec25372b53d2b05c67ce3d39bf24a07bcdeb8dd7202deea0
SSDEEP
1536:5CRsEx+LNl/kiwxjk83iGtiF1Wx7JO0N70DvU:4RaLNvCjDiiCWt70D
Checks for missing Authenticode signature.
resource |
---|
bcdfc8de4c8ebafbc8e21170854ee760_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedDecrement
HeapDestroy
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
CreateDirectoryA
FreeLibrary
LoadLibraryA
GetCurrentProcessId
Sleep
MoveFileA
InterlockedIncrement
Process32Next
Process32First
GetProcAddress
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
WritePrivateProfileStringA
GetCommandLineW
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetFileAttributesA
ExitProcess
LocalFree
WideCharToMultiByte
lstrlenW
CreateThread
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
strstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcmp
strncmp
strncpy
_access
??3@YAXPAX@Z
strlen
atoi
strchr
wcsstr
_wcslwr
memset
strcat
strcpy
sprintf
_strupr
??2@YAPAXI@Z
strrchr
memcpy
_purecall
memcmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ