DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
c13f485a9e052e34199ec69cd132c7e8_JaffaCakes118.dll
Resource
win7-20240708-en
Target
c13f485a9e052e34199ec69cd132c7e8_JaffaCakes118
Size
52KB
MD5
c13f485a9e052e34199ec69cd132c7e8
SHA1
52ff1974f7b693e1e64ffcb16e97dd3ee11ec707
SHA256
fa65e02d2912e82f48cfd74500c6f22d3db60f41c22144ebc24526b2b325e01d
SHA512
f760f5352e69d10d408aa904a2f7e647c632cbb0a11a532c97b4fc6fe7bf0b7ae75e38e87741e914711903ecb77f75e223c8f96e6b578feb4f1fe95d8380cbda
SSDEEP
1536:wllouDgeeHJCQwU//yU18m43HIg2z6A2It6M:KlxceIb/y1ogCH6
Checks for missing Authenticode signature.
resource |
---|
c13f485a9e052e34199ec69cd132c7e8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
WritePrivateProfileStringA
FreeLibrary
GetProcAddress
LoadLibraryA
lstrlenA
WideCharToMultiByte
lstrlenW
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CreateThread
RemoveDirectoryA
CreateDirectoryA
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
LocalFree
Process32First
Process32Next
GetCommandLineW
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
CloseHandle
ExitProcess
GetExitCodeProcess
Sleep
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strcmp
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
_purecall
memcpy
strchr
atoi
_access
??3@YAXPAX@Z
sprintf
memset
strlen
strcat
strcpy
memcmp
strstr
strrchr
??2@YAPAXI@Z
_strupr
fclose
fread
ftell
fseek
fopen
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ