DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
05e9626ab7ca66c12980360032303ea6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
05e9626ab7ca66c12980360032303ea6_JaffaCakes118
Size
60KB
MD5
05e9626ab7ca66c12980360032303ea6
SHA1
f3d02b8188e3cedf1c6a1c1ff8da7138bbee76fc
SHA256
9dcb0dc9f87fcee4519a35b663ab767ab778ffb95fa0fc69f9cccfc64e6a7084
SHA512
c1e004be3ebb463487c04717acb2e2167d6876773205870d1c4b81d4b1b5dc24d9fcb271fa04ebb8e7e53bb68a4ec73e10296ad4971723b14b4d4594135ccf0c
SSDEEP
768:Lg89qOUuLZ2WBgWslAFp5yJZaxCLwGlvfBrIj0hWwr/YAmJnh8+xqexhxUdql:LwsLvsqpskxCLwGXm0hQDq65Gdu
Checks for missing Authenticode signature.
resource |
---|
05e9626ab7ca66c12980360032303ea6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetModuleHandleA
RemoveDirectoryA
GetCurrentProcessId
LocalFree
WritePrivateProfileStringA
MoveFileA
CreateDirectoryA
Process32Next
Process32First
CreateThread
LoadLibraryA
GetProcAddress
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
ExitProcess
GetCommandLineW
Sleep
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetShortPathNameA
SetEntriesInAclA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryValueExA
GetNamedSecurityInfoA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
strcat
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
atoi
strcmp
_access
_wcslwr
strstr
sprintf
memset
strncpy
strchr
strncmp
strlen
strcpy
??3@YAXPAX@Z
strrchr
_stricmp
memcmp
memcpy
_purecall
??2@YAPAXI@Z
wcsstr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ