DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
be2b62eecea7e7eaca2b978d690e9342_JaffaCakes118.dll
Resource
win7-20240705-en
Target
be2b62eecea7e7eaca2b978d690e9342_JaffaCakes118
Size
60KB
MD5
be2b62eecea7e7eaca2b978d690e9342
SHA1
14f68026afedbe61f35f27c645ba7b02e03e485c
SHA256
1dfe9d453139126ccc7d045f88311a2bea7ad7795341ef96582cd5687ee7df20
SHA512
ada27148bef473385d78dde733a708965fd7ec711ad8ba2211d9b08c893a1cbd1eda51017f16fb68cc294fb4541c21851cf64019c54eaed101f32c2fd9f536b1
SSDEEP
768:ywXeibzZsRpZAVTfc3ORv+wvhT6zFcxpPELVfFypxEWGLg10VYdnJUcnQIsdvki:/vWgx1RWwvgzEIyHEWGagYdHQIsdvki
Checks for missing Authenticode signature.
resource |
---|
be2b62eecea7e7eaca2b978d690e9342_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
DeleteFileA
WritePrivateProfileStringA
CreateProcessA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetProcAddress
LoadLibraryA
InterlockedDecrement
MoveFileA
GetCurrentProcessId
CreateDirectoryA
GetSystemDirectoryA
CreateThread
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
Sleep
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
CloseHandle
ExitProcess
SetFileAttributesA
LocalFree
FreeLibrary
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegDeleteKeyA
RegEnumKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
??2@YAPAXI@Z
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
strchr
atoi
_access
strcmp
_wcslwr
wcsstr
strrchr
strlen
memset
strcat
strcpy
sprintf
??3@YAXPAX@Z
memcmp
memcpy
strstr
_purecall
_strupr
fclose
fread
ftell
fseek
fopen
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ