DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
d054967152cc2102ce722bcd63717016_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d054967152cc2102ce722bcd63717016_JaffaCakes118
Size
52KB
MD5
d054967152cc2102ce722bcd63717016
SHA1
a025d168489c6c8fc8f7cb8879aea87e155774a3
SHA256
c674e477d02f9c9c812a07a86258e863701b5fe7461f569731223c8185db44ad
SHA512
768ad8ef1cd942bca59f48ccbe3dc702757e2b05a0c99fca59eab815a2dee8fc42b8dbf13c796a6c9ccb0f0ab7c5eabf7c843da5c9b124c29960a7df7fbb6e8a
SSDEEP
1536:TjdLlWW/AV6ai8boRF38d28urfqBsYRoSJ/UpW/S:PdLx/Ko7xrfG9UpWK
Checks for missing Authenticode signature.
resource |
---|
d054967152cc2102ce722bcd63717016_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WideCharToMultiByte
CloseHandle
CreateProcessA
GetSystemDirectoryA
CreateThread
SetFileAttributesA
DeleteFileA
MoveFileA
FreeLibrary
FindNextFileA
GetPrivateProfileStringA
GetModuleFileNameA
Process32Next
Process32First
Sleep
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
CreateDirectoryA
GetCommandLineW
RemoveDirectoryA
WritePrivateProfileStringA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LocalFree
LoadLibraryA
GetProcAddress
ExitProcess
LeaveCriticalSection
EnterCriticalSection
FindFirstFileA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
fclose
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
_access
_wcslwr
wcsstr
strncmp
strchr
strncpy
strcpy
strlen
sprintf
??3@YAXPAX@Z
strstr
memset
memcpy
_purecall
??2@YAPAXI@Z
memcmp
strcmp
strrchr
_strlwr
fread
ftell
fseek
fopen
strcat
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ