DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
bd0ac3a73e9700622ee7f236e360a0c4_JaffaCakes118.dll
Resource
win7-20240704-en
Target
bd0ac3a73e9700622ee7f236e360a0c4_JaffaCakes118
Size
60KB
MD5
bd0ac3a73e9700622ee7f236e360a0c4
SHA1
4a19bbe9c93f27985cf9fd8a4b1a131728a7885b
SHA256
a26b2449bd155a9ee06c5448d4ed4fd96efe797c176ac3da76f7b06ccfbac5ed
SHA512
bff18563fa2a1bf21e3c6e363877052be1563cc69f1b6b3634f3dec8b37a6d2bdd62f1ca844d37e106fa5e833314770e89749a93f190f408d9e0090fc878f158
SSDEEP
1536:M+t92hWyYs3cyqyhkelQmcvUWCqlxKzoV:KYrAk3jCq8oV
Checks for missing Authenticode signature.
resource |
---|
bd0ac3a73e9700622ee7f236e360a0c4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindFirstFileA
GetProcAddress
LoadLibraryA
SetFileAttributesA
FreeLibrary
MoveFileA
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
GetPrivateProfileStringA
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
WritePrivateProfileStringA
RemoveDirectoryA
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateThread
ExitProcess
DeleteFileA
FindNextFileA
GetCommandLineW
lstrlenA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
GetSystemDirectoryA
CreateProcessA
LocalFree
GetModuleFileNameA
CloseHandle
EnterCriticalSection
CreateDirectoryA
LeaveCriticalSection
HeapDestroy
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
strrchr
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
atoi
_wcslwr
wcsstr
strncmp
strchr
strncpy
fopen
fseek
ftell
_access
strcat
??3@YAXPAX@Z
strlen
memset
strcpy
sprintf
strstr
??2@YAPAXI@Z
strcmp
_strlwr
memcpy
_purecall
memcmp
fclose
fread
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ