DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
be7025a6e09823d6004ac8789806fa75_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
be7025a6e09823d6004ac8789806fa75_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
be7025a6e09823d6004ac8789806fa75_JaffaCakes118
Size
72KB
MD5
be7025a6e09823d6004ac8789806fa75
SHA1
f79c5096cc39ec0f962d4da6381a5226507d98b1
SHA256
2140164d7ee6d6bb2998d041217191643fa7cea63dfa7a4f4d3fd2211dc3879a
SHA512
b6ff2d9933e5e0b28c73fd95705093c22e9ef1e65a62dbeb7eb0085cfd9574581cf6640cf1c48c3d718fb39b9f803a1587081be07c0623e288ca1bf5a410c325
SSDEEP
1536:xxNqX8cfiop9Dir45EVG1iTKZJZaCKVFPiYl4B2p:K4nci2aCKXPAB2p
Checks for missing Authenticode signature.
resource |
---|
be7025a6e09823d6004ac8789806fa75_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
Process32Next
Process32First
ExitProcess
WideCharToMultiByte
lstrlenW
CreateThread
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
WritePrivateProfileStringA
GetProcAddress
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateDirectoryA
lstrlenA
LoadLibraryA
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
RemoveDirectoryA
CreateProcessA
Sleep
MultiByteToWideChar
SetFileAttributesA
MoveFileA
DeleteFileA
GetCommandLineW
GetNamedSecurityInfoA
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
_access
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
_purecall
_wcslwr
wcsstr
fopen
fseek
ftell
fread
fclose
??3@YAXPAX@Z
strstr
sprintf
strlen
strncpy
strchr
memset
strncmp
strcpy
strcat
_stricmp
strrchr
??2@YAPAXI@Z
memcmp
memcpy
atoi
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ