DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
c10b9c3e3ef6ad7ad82de54a9189746d_JaffaCakes118.dll
Resource
win7-20240708-en
Target
c10b9c3e3ef6ad7ad82de54a9189746d_JaffaCakes118
Size
64KB
MD5
c10b9c3e3ef6ad7ad82de54a9189746d
SHA1
6b6da6e402d3cf4b919b93ce042a5fa98fe2e5f8
SHA256
4063ea797aba809ad6d5c3ae1d239f239c7f496d375d71071aa582286f09496d
SHA512
865a69f9cab08534e7c93a2f9000ac3d322b7f86b35cdc907575b60ffdd7b6fe3a9be63519e91835ffe968c05bb77211a9aff84c08a69bb56aba8e2442f64b15
SSDEEP
1536:Zyy2scyRvfIIFvix7nbdjLOCSv0Ckn7cpLl:h2sQxrNCkn72
Checks for missing Authenticode signature.
resource |
---|
c10b9c3e3ef6ad7ad82de54a9189746d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
LoadLibraryA
GetProcAddress
LocalFree
CloseHandle
GetCurrentProcessId
Sleep
MoveFileA
lstrlenA
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
RemoveDirectoryA
Process32Next
Process32First
GetCommandLineW
ExitProcess
CreateThread
CreateDirectoryA
MultiByteToWideChar
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
WritePrivateProfileStringA
FindNextFileA
GetExitCodeProcess
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
memcmp
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
fopen
fseek
ftell
fread
fclose
_access
_wcslwr
wcsstr
??3@YAXPAX@Z
sprintf
strstr
memset
strrchr
strcat
strlen
memcpy
_purecall
??2@YAPAXI@Z
_strlwr
strcpy
strncpy
strchr
strncmp
atoi
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ