DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
ead514bde1109293c5ae02baa97326c3_JaffaCakes118.dll
Resource
win7-20240903-en
Target
ead514bde1109293c5ae02baa97326c3_JaffaCakes118
Size
52KB
MD5
ead514bde1109293c5ae02baa97326c3
SHA1
ea23d332042060be3d0bdb44dc998c960d784875
SHA256
1c9bc67a2e15ce6d2316e3cc064fbed8bba13aea14aba14b754840b742928107
SHA512
03979c678432455b93104b30fe04ec6254905fd82dc6ddf7e2546ee2e945ca3dd53bc70fff35e81193b7274ef8d3f023ac2ad4dd9e04a272ad7f63a16276ab96
SSDEEP
1536:VG16iKqxq32EreadkVIU7wRm3grZJGIZ:U6i7sXrYt3QGIZ
Checks for missing Authenticode signature.
resource |
---|
ead514bde1109293c5ae02baa97326c3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
FreeLibrary
WideCharToMultiByte
FindNextFileA
DeleteFileA
GetPrivateProfileStringA
FindFirstFileA
MoveFileA
SetFileAttributesA
WritePrivateProfileStringA
CreateProcessA
GetModuleHandleA
Sleep
CreateThread
LocalFree
GetCurrentProcessId
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
CreateDirectoryA
ExitProcess
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
Process32First
Process32Next
CloseHandle
GetProcAddress
LoadLibraryA
GetSystemDirectoryA
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
GetNamedSecurityInfoA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strlen
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_access
atoi
_wcslwr
wcsstr
strncmp
strchr
strncpy
strcmp
strcat
??3@YAXPAX@Z
strcpy
memcpy
_purecall
??2@YAPAXI@Z
memcmp
strstr
sprintf
strrchr
_strupr
fclose
fread
memset
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ