DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
fd651e36dca8b7a4870246e82c56249d_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fd651e36dca8b7a4870246e82c56249d_JaffaCakes118
Size
76KB
MD5
fd651e36dca8b7a4870246e82c56249d
SHA1
fec6558cfc680bb445d397bb2399421c57811ccd
SHA256
d51e23b7bde6b7fc05dfd68f87a71aa90506dd1feb73546ed7f69d9e2c2fcfd2
SHA512
e9b9aa321f62f3bafee2768b14baf5acb0f400de53d458a7f552dcb650f830458eacaaa4b05d013f32b30074d2f2fb2658c3ceb117bba74c36b39cb8a65e2b35
SSDEEP
1536:j6JcFdEwK5Zk9lN1ZkJhd0ftZKC5ZyaNiqA1Sdv88L:HnEwK5cZkCKGiWdE8L
Checks for missing Authenticode signature.
resource |
---|
fd651e36dca8b7a4870246e82c56249d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetSystemDirectoryA
LocalFree
SetFileAttributesA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCurrentProcessId
ExitProcess
GetExitCodeProcess
WaitForSingleObject
CreateThread
WritePrivateProfileStringA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
GetCommandLineW
CreateDirectoryA
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
FreeLibrary
LoadLibraryA
GetProcAddress
Sleep
DeleteFileA
RemoveDirectoryA
CreateProcessA
Process32First
CloseHandle
Process32Next
DisableThreadLibraryCalls
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteKeyA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
??2@YAPAXI@Z
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
fopen
fseek
ftell
fread
fclose
strcmp
_purecall
strcpy
strcat
memset
_access
sprintf
??3@YAXPAX@Z
strstr
memcmp
wcsstr
_wcslwr
_strupr
strrchr
strlen
atoi
strchr
memcpy
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ