DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
fcae3f8f4bc34346f49ed04d77afb171_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fcae3f8f4bc34346f49ed04d77afb171_JaffaCakes118
Size
64KB
MD5
fcae3f8f4bc34346f49ed04d77afb171
SHA1
162fa33584679847b28d4dd824d1eea05c4f3c3a
SHA256
51dcf0199d00a87d435662c11a50a4cf719e1f6d5c19173425600f6d6573ff20
SHA512
b80cdc1f340b9f6258b2adfee4994fa72d4a59e88c82db5a676131f4aa56c49023fbf245f93fbdf46018837748a7ae23a4ac41300b05f0b01984b3dc2c1517e6
SSDEEP
1536:+otuM0UmnlGa3Skomb3i5ygb0zybuEhGUGHtI9:rt3ls/fIygbfbuMItI
Checks for missing Authenticode signature.
resource |
---|
fcae3f8f4bc34346f49ed04d77afb171_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32Next
Process32First
GetCommandLineW
GetProcAddress
ExitProcess
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
CreateThread
RemoveDirectoryA
CloseHandle
lstrlenW
WideCharToMultiByte
LoadLibraryA
FreeLibrary
GetModuleFileNameA
Sleep
CreateDirectoryA
WritePrivateProfileStringA
MultiByteToWideChar
DeleteFileA
MoveFileA
LocalFree
SetFileAttributesA
DisableThreadLibraryCalls
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strrchr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
??2@YAPAXI@Z
_purecall
strncmp
strncpy
sprintf
strlen
??3@YAXPAX@Z
_access
strcat
memset
strcpy
memcmp
memcpy
strcmp
_strupr
strstr
wcsstr
_wcslwr
atoi
strchr
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ