DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f9fc1767fa0b5171149d968b972c67d8_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
f9fc1767fa0b5171149d968b972c67d8_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
f9fc1767fa0b5171149d968b972c67d8_JaffaCakes118
Size
80KB
MD5
f9fc1767fa0b5171149d968b972c67d8
SHA1
c956fb321d17ae04b658c88a20c76f87e6e69cfa
SHA256
8a2d4dfcaa411b5e22d7ed6fa251998b21c6963c9dbb4294cbad6522d144b806
SHA512
495955ad38a506036371223f74c24aff6de3f201419fcac93d5e0adc9351f6cd8a0c364b0cb693c4c6a09a4275abf033978af85533dabc5035dba9d06b50ed49
SSDEEP
1536:ECQSwDk/SM3ZVSX0P4H0WzHS9jrBi+VWxSlvBz:EWnq+cX2JWzqBiLSlv5
Checks for missing Authenticode signature.
resource |
---|
f9fc1767fa0b5171149d968b972c67d8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
GetProcAddress
CreateDirectoryA
Sleep
Process32Next
Process32First
GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
FindNextFileA
GetPrivateProfileStringA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
ExitProcess
GetCommandLineW
lstrlenA
GetCurrentProcessId
CreateThread
LocalFree
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
lstrlenW
WideCharToMultiByte
FreeLibrary
LoadLibraryA
FindFirstFileA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
_access
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_purecall
atoi
strstr
strcmp
strncmp
strchr
strncpy
strrchr
fopen
??3@YAXPAX@Z
sprintf
wcsstr
_wcslwr
strlen
memset
strcat
strcpy
memcmp
memcpy
_strupr
fclose
fread
??2@YAPAXI@Z
ftell
fseek
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ