DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ea17aa8549d9d81e8be737fe92aea65b_JaffaCakes118.dll
Resource
win7-20240903-en
Target
ea17aa8549d9d81e8be737fe92aea65b_JaffaCakes118
Size
64KB
MD5
ea17aa8549d9d81e8be737fe92aea65b
SHA1
b178164a2281876aa29f7926e00922334da07859
SHA256
1c933466bd98d85b3e0d6595532dd8a43fbef161d156b4b6d59f103d330f750f
SHA512
e7e3cd64a97044114037dcc66d0b8e786dda9afb3e16687d29fbf2b939d332c609da6ca3cc7e24a45f9cdb65fe142eb7298629e89a0a5fd113eabaa17e975afd
SSDEEP
768:O5aotBO7Wplg2mbNpvJHT1p862EQuvZh8iZQXoCqYZImcnUX95UaqHiHPMM2iX:O5Vn8WpAbxYETIW5YZIeIpiHPJj
Checks for missing Authenticode signature.
resource |
---|
ea17aa8549d9d81e8be737fe92aea65b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteFileA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
Process32Next
Process32First
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
GetSystemDirectoryA
SetFileAttributesA
MoveFileA
ExitProcess
RemoveDirectoryA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
WritePrivateProfileStringA
CreateDirectoryA
GetCurrentProcessId
CreateProcessA
CreateThread
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
lstrlenW
FreeLibrary
Sleep
LoadLibraryA
GetProcAddress
LocalFree
CloseHandle
GetModuleFileNameA
DisableThreadLibraryCalls
SetNamedSecurityInfoA
SetEntriesInAclA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoUninitialize
SysFreeString
SysAllocString
SysStringLen
LoadRegTypeLi
VariantClear
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
strrchr
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
atoi
fopen
fseek
ftell
fread
fclose
_access
memcpy
memcmp
??2@YAPAXI@Z
strstr
strncmp
strlen
memset
strcat
strcpy
sprintf
strcmp
_strlwr
wcsstr
_wcslwr
??3@YAXPAX@Z
strncpy
strchr
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ