DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
fce8f760f0674e674ce6fb9777bb766a_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fce8f760f0674e674ce6fb9777bb766a_JaffaCakes118
Size
60KB
MD5
fce8f760f0674e674ce6fb9777bb766a
SHA1
4523363f99758569719d76fa9395c31f2e3bc1c6
SHA256
1e35bf42abb13cb1c79eb33ec190d7b4df1546919cd2de039d01590f3cc6d86a
SHA512
271845088da71a5642b240b2b3b94eeddd49d877188174273d1fa37a73fff930c3d999d7acc6e8027bad14c3a07d7ebb289a99ed0bf2b4a88b89579e2510fca9
SSDEEP
1536:9kX7N0t4Q5pO3IPfE7j3LWMvFcSs4N4uusX5:2LN0t5O3EcfbWMxsq4uusX
Checks for missing Authenticode signature.
resource |
---|
fce8f760f0674e674ce6fb9777bb766a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
CreateThread
GetExitCodeProcess
WaitForSingleObject
LocalFree
SetFileAttributesA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
Sleep
CreateDirectoryA
GetCurrentProcessId
Process32Next
Process32First
DeleteFileA
ExitProcess
WritePrivateProfileStringA
GetCommandLineW
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
MoveFileA
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
fseek
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_access
_wcslwr
wcsstr
strchr
atoi
_purecall
memcpy
memset
sprintf
memcmp
??3@YAXPAX@Z
strcmp
strrchr
fclose
fread
??2@YAPAXI@Z
ftell
_strlwr
fopen
strcat
strlen
strcpy
strstr
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ