DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
0edbba99df5e6f8f9e3c13bc2db0a3c6_JaffaCakes118.dll
Resource
win7-20240708-en
Target
0edbba99df5e6f8f9e3c13bc2db0a3c6_JaffaCakes118
Size
64KB
MD5
0edbba99df5e6f8f9e3c13bc2db0a3c6
SHA1
bf6beb34df8549fe9971ffa10bf306c641b38251
SHA256
e89f9626441907cb02c1a1a1ffc82fdff0f572a3ef497dc3d201bd08e6f09721
SHA512
f4c9deb16703323cfaf9803b344d181b8d5c31c13d1f3cafb32c55195fc25265b3b1b500ff80d04a7a69cef4edc744179fdcd9f6383d723334ae799d31e66923
SSDEEP
1536:XRI8JioBMBQuuO2FpAYaDrjDyfcNi2rtRcth:W8JUgOTYaDfefmrkt
Checks for missing Authenticode signature.
resource |
---|
0edbba99df5e6f8f9e3c13bc2db0a3c6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WritePrivateProfileStringA
FindNextFileA
DeleteFileA
GetPrivateProfileStringA
FindFirstFileA
CloseHandle
CreateProcessA
GetSystemDirectoryA
LocalFree
GetModuleHandleA
GetCommandLineW
ExitProcess
SetFileAttributesA
Sleep
CreateDirectoryA
Process32Next
Process32First
GetCurrentProcessId
MoveFileA
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
CreateThread
GetModuleFileNameA
GetProcAddress
LoadLibraryA
WideCharToMultiByte
RegCreateKeyExA
RegSetValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strstr
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
atoi
strncmp
strchr
strncpy
_access
fopen
fseek
ftell
fread
??3@YAXPAX@Z
memset
strlen
sprintf
memcpy
_purecall
??2@YAPAXI@Z
memcmp
strcmp
strrchr
_stricmp
strcat
strcpy
wcsstr
_wcslwr
fclose
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ