DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
d1cf394270c497459021c0dde9cedc67_JaffaCakes118.dll
Resource
win7-20240704-en
Target
d1cf394270c497459021c0dde9cedc67_JaffaCakes118
Size
64KB
MD5
d1cf394270c497459021c0dde9cedc67
SHA1
7bb76587d97350987a004cdb698f4b2a0870bef8
SHA256
287b7cd05139e0d2e69e92c9d382c996fa6624572ef2619b5cbf553483511a69
SHA512
6aa35e992aafe41583b52ceeb972f644c845349bdef61f3fabcb47071cfd330e486f2ea1e55a191ff814085ac7884cba66479fb0833aafe26eb0357a3258f0a3
SSDEEP
1536:zUg7mC2UZl2mrvpride6/oIfqOVXcRgj11Gu:zLmC2UZadeE/jk611G
Checks for missing Authenticode signature.
resource |
---|
d1cf394270c497459021c0dde9cedc67_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
WideCharToMultiByte
FindNextFileA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
CreateProcessA
RemoveDirectoryA
LocalFree
CloseHandle
GetSystemDirectoryA
GetExitCodeProcess
WaitForSingleObject
Sleep
Process32Next
Process32First
CreateThread
WritePrivateProfileStringA
CreateDirectoryA
MoveFileA
GetCurrentProcessId
LoadLibraryA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
DisableThreadLibraryCalls
ExitProcess
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strrchr
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strcmp
strncmp
strncpy
fopen
fseek
ftell
fread
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
strstr
atoi
strchr
sprintf
memset
_stricmp
strcat
strcpy
_access
strlen
fclose
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ