DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f6c84d5697b33308484b3f7a88494989_JaffaCakes118.dll
Resource
win7-20240903-en
Target
f6c84d5697b33308484b3f7a88494989_JaffaCakes118
Size
52KB
MD5
f6c84d5697b33308484b3f7a88494989
SHA1
270a45c8bc52ee469c2574df720d465c5c19a1db
SHA256
3db3928ea914a759ba1e0fe9c264e054c6fd1c3d44aa32cd858abd88bacacad5
SHA512
c542fc2348411dbe736ae26492cdad7862a1b55b176a6fb2627a03a527d865b378a168b89ae9f5052b17660cbf30e56d3e9f9c468070efeccc79d4c756e4d947
SSDEEP
1536:AhYrv71+UDloAdL9Zsq/0lG/O2gskMipKL/AcAER:AAvYbq4Gm2TkMiwL/A4
Checks for missing Authenticode signature.
resource |
---|
f6c84d5697b33308484b3f7a88494989_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LocalFree
CloseHandle
CreateProcessA
GetSystemDirectoryA
WideCharToMultiByte
SetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
DeleteFileA
FreeLibrary
CreateDirectoryA
GetCommandLineW
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCurrentProcessId
CreateThread
Process32Next
Process32First
RemoveDirectoryA
ExitProcess
WritePrivateProfileStringA
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenA
MultiByteToWideChar
Sleep
GetProcAddress
LoadLibraryA
MoveFileA
RegQueryValueExA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
??2@YAPAXI@Z
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strcmp
atoi
_access
strrchr
fopen
fseek
ftell
??3@YAXPAX@Z
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
memcpy
_purecall
_strupr
memcmp
strstr
strcat
fclose
fread
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ