DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
d374e6c8444fee78887b16ed3971b1b6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d374e6c8444fee78887b16ed3971b1b6_JaffaCakes118
Size
60KB
MD5
d374e6c8444fee78887b16ed3971b1b6
SHA1
2163253e04fa0a31549d1ee1625b2f09c1154d05
SHA256
963058f08f5afb48d6be1047a921fbd72df48f4b5b3589c283cee8d7d5e019e5
SHA512
31b5d97ee08eb418136995ac2d1fa5cae748c94662612407f77bce8052cfa98b48fd09c3ed64d09fd03594ccca2d479f9e0f311a373850cff393ed9bfd79a9ff
SSDEEP
1536:lmDGLIn1ufp6Hz90n/8hJEmaXIQ0hIcK:eGo1xz/JfnQ0+/
Checks for missing Authenticode signature.
resource |
---|
d374e6c8444fee78887b16ed3971b1b6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CreateThread
FreeLibrary
LoadLibraryA
WideCharToMultiByte
Sleep
GetProcAddress
CloseHandle
CreateProcessA
RemoveDirectoryA
DeleteFileA
Process32Next
GetModuleHandleA
MoveFileA
GetCurrentProcessId
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
ExitProcess
GetSystemDirectoryA
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
WritePrivateProfileStringA
GetModuleFileNameA
SetFileAttributesA
GetCommandLineW
LocalFree
Process32First
RegSetValueExA
RegCreateKeyExA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegDeleteKeyA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memcmp
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_wcslwr
wcsstr
fopen
fseek
ftell
fread
fclose
strstr
strcmp
strrchr
sprintf
memset
strlen
??3@YAXPAX@Z
memcpy
_purecall
??2@YAPAXI@Z
_strupr
strcat
strcpy
_access
atoi
strchr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ