DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
d1e8010820028a9f638faf742a5b47ca_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d1e8010820028a9f638faf742a5b47ca_JaffaCakes118
Size
56KB
MD5
d1e8010820028a9f638faf742a5b47ca
SHA1
f33c113b942e97416e73947d1df7f8c16214afd2
SHA256
416871d8b7abc6475d10fa18d7aa208cd15970ba9ba1192f1a09a647494165ea
SHA512
68743e781e78347b335c77e3444e9f0cb0e53780a338fb35cf752f7db43a8b5afbd363d60a07a978fde01859e8cbe293ecdbf74d9a3a31c7fee3b776742845af
SSDEEP
1536:jLGm3o/qHrNNdJaG5KKDEtXUEMqama/qPoxeloYf+g0:jL4SLSqKBtkL8Zlyg
Checks for missing Authenticode signature.
resource |
---|
d1e8010820028a9f638faf742a5b47ca_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetPrivateProfileStringA
FindFirstFileA
CreateThread
GetProcAddress
ExitProcess
LeaveCriticalSection
EnterCriticalSection
Process32Next
Process32First
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
SetFileAttributesA
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetExitCodeProcess
WaitForSingleObject
GetCommandLineW
WritePrivateProfileStringA
CreateDirectoryA
MoveFileA
DeleteFileA
FindNextFileA
GetCurrentProcessId
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
LoadLibraryA
FreeLibrary
Sleep
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
LocalFree
InterlockedDecrement
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcat
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
_access
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
strcmp
memset
sprintf
??3@YAXPAX@Z
strstr
??2@YAPAXI@Z
memcmp
memcpy
wcsstr
_wcslwr
strrchr
_strlwr
atoi
strchr
strcpy
_purecall
strlen
SHDeleteKeyA
SHSetValueA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ