DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f6cf4c36431488588185b0e1479d9cc1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
f6cf4c36431488588185b0e1479d9cc1_JaffaCakes118
Size
64KB
MD5
f6cf4c36431488588185b0e1479d9cc1
SHA1
80affa021a2d084d35f3aaf2bc7fd166c055c3e5
SHA256
edd190605c914ed7990b58476f4904881b2a0c8a7986eb549ed10c45ef69c168
SHA512
681ff83ea7a2deb459e06f3c77c8bcb30f039e657f31dc193e90c9606955f98c1c6414d123fb1f4201dd63ef251ea922d87f1f42c1c351559c64943e505c54ff
SSDEEP
1536:y9Ntp0TmdVDDIO7Tz1K8nKa68MJytn1+rv:y93DI4s8nLeotn1+rv
Checks for missing Authenticode signature.
resource |
---|
f6cf4c36431488588185b0e1479d9cc1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
LocalFree
SetFileAttributesA
Process32Next
Process32First
WritePrivateProfileStringA
CreateDirectoryA
RemoveDirectoryA
LeaveCriticalSection
WideCharToMultiByte
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
lstrlenA
MultiByteToWideChar
lstrlenW
GetProcAddress
CreateThread
DeleteFileA
GetCommandLineW
Sleep
LoadLibraryA
FreeLibrary
ExitProcess
GetSystemDirectoryA
GetModuleFileNameA
CloseHandle
CreateProcessA
EnterCriticalSection
RegDeleteKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
ftell
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
_purecall
_access
strncmp
strchr
strncpy
_wcslwr
wcsstr
strcpy
memset
sprintf
??3@YAXPAX@Z
strstr
strlen
strcmp
strrchr
fclose
fread
??2@YAPAXI@Z
_stricmp
fseek
fopen
strcat
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ