DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0dfff2c2e736e9ab44f1a5f71d38c1a4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
0dfff2c2e736e9ab44f1a5f71d38c1a4_JaffaCakes118
Size
44KB
MD5
0dfff2c2e736e9ab44f1a5f71d38c1a4
SHA1
ef05213a4d95eba12865d828203c1e42b1ad15bc
SHA256
b09e16bd42fa3915615032be55fa580daee5ff1c828fcb1714f13d074b9ea83d
SHA512
499f7e4fb6e09adb3c5745df3bc914e9a5aa4c28b947f3cb9af33461f2a4708068b7b6fccf0ab6058e785d56f2ba951ea62e4000cd8a6504ae61194c9d30d810
SSDEEP
768:O0tubeOWALMPW/ZlJYd5v4qbTOfNA0HWwGlz2:O0tujWAwwdcv/bYG0bGlz
Checks for missing Authenticode signature.
resource |
---|
0dfff2c2e736e9ab44f1a5f71d38c1a4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WaitForSingleObject
CreateProcessA
GetModuleFileNameA
GetSystemDirectoryA
GetProcAddress
LoadLibraryA
FindNextFileA
FindFirstFileA
LeaveCriticalSection
EnterCriticalSection
ExitProcess
MultiByteToWideChar
lstrlenA
DisableThreadLibraryCalls
InitializeCriticalSection
GetExitCodeProcess
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
Sleep
FreeLibrary
MoveFileA
DeleteFileA
SetFileAttributesA
Process32First
Process32Next
CloseHandle
GetCommandLineW
lstrlenW
WideCharToMultiByte
CreateThread
DeleteCriticalSection
GetCurrentProcessId
SetWindowTextA
FindWindowExA
IsWindow
SendMessageA
RegEnumKeyExA
RegCloseKey
RegQueryInfoKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoInitialize
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
memset
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
strncmp
strchr
strncpy
_wcslwr
wcsstr
memcmp
_purecall
memcpy
strcmp
??2@YAPAXI@Z
strlen
??3@YAXPAX@Z
strstr
strcpy
_strupr
sprintf
strrchr
strcat
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ