DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
fcc529168d78aaf2d98619e535783f9a_JaffaCakes118.dll
Resource
win7-20240708-en
Target
fcc529168d78aaf2d98619e535783f9a_JaffaCakes118
Size
72KB
MD5
fcc529168d78aaf2d98619e535783f9a
SHA1
3c923f71ac81f6d41496fe579d77ad61a2b4c7f0
SHA256
3c3f66e04f1790e7d149294920d4260a319d12cf9ea1e447414e7f191fe1e262
SHA512
c2a943ce03ba796fb0f30ea1be3365f8d9bc4fc555fc9e806dd414f0a97313f2519049226ac7d52a642f66389473a95e46190576d7a32619588c0db2715e8280
SSDEEP
1536:cYSKTZCHzkQntHRnBr00FMFES6gnrXK9lTBu95:mKToAOt5BOF4UrXKVu
Checks for missing Authenticode signature.
resource |
---|
fcc529168d78aaf2d98619e535783f9a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
CreateProcessA
RemoveDirectoryA
DeleteFileA
Sleep
CreateDirectoryA
FindNextFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
WritePrivateProfileStringA
lstrlenA
GetExitCodeProcess
CloseHandle
WaitForSingleObject
GetSystemDirectoryA
Process32Next
Process32First
MoveFileA
GetCurrentProcessId
MultiByteToWideChar
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenW
WideCharToMultiByte
CreateThread
LocalFree
GetCommandLineW
LoadLibraryA
ExitProcess
FreeLibrary
GetProcAddress
RegSetValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryValueExA
RegCreateKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memcmp
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
strcmp
fopen
fseek
ftell
fread
fclose
strrchr
strncmp
??3@YAXPAX@Z
memset
sprintf
strstr
??2@YAPAXI@Z
wcsstr
_wcslwr
strlen
memcpy
_purecall
_stricmp
strcat
strcpy
_access
strncpy
strchr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ