DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
d751ae15ef4bb04dda8e4300b1a633f2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d751ae15ef4bb04dda8e4300b1a633f2_JaffaCakes118
Size
72KB
MD5
d751ae15ef4bb04dda8e4300b1a633f2
SHA1
b6d4e99f4d3b3a83aead5fbafb02e89502b132cd
SHA256
44e24dd245c02097354cc63a98dd215faed29a38c9ec8d66d6eebd647afabc81
SHA512
74b519eb9d7a917d0a76480f6a7859e57243e6bc6e04b1dc1a756d5d2f459068ddbe64f179c835ce5a7f5b1b04077f754249b670466e2bf2f97e17b928237494
SSDEEP
768:Xh7BGl9XbZiOKRvOe3PpLSMYbnnvL85jL32tQsLlstqrSjamFXIe:Xh7M9LnxefxSTbTBflsMIamK
Checks for missing Authenticode signature.
resource |
---|
d751ae15ef4bb04dda8e4300b1a633f2_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenW
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
CreateProcessA
RemoveDirectoryA
DeleteFileA
GetCurrentProcessId
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
HeapDestroy
ExitProcess
GetProcAddress
WideCharToMultiByte
Sleep
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
WritePrivateProfileStringA
MoveFileA
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
CreateThread
LoadLibraryA
FreeLibrary
LocalFree
Process32First
CloseHandle
Process32Next
CreateDirectoryA
RegDeleteKeyA
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoUninitialize
SysFreeString
LoadRegTypeLi
SysStringLen
SysAllocString
VariantClear
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
memcpy
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
_wcslwr
wcsstr
strchr
atoi
strrchr
fopen
fseek
ftell
fread
fclose
sprintf
strcpy
??3@YAXPAX@Z
strstr
memset
strlen
_strupr
_purecall
??2@YAPAXI@Z
memcmp
strcat
_access
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ