DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1115863354f4ced996d602a302030ee2_JaffaCakes118.dll
Resource
win7-20240903-en
Target
1115863354f4ced996d602a302030ee2_JaffaCakes118
Size
60KB
MD5
1115863354f4ced996d602a302030ee2
SHA1
e46f38be715014a260d29f4fad0f220b4622161f
SHA256
b63ce55723c265745e0541fdde856e43f1ef999a5e8fac8c8e5cbf124b595c7d
SHA512
6c5dfe959c4e78b41b8fbeb26a5f6349f53963347f710d14cc751619329ef9c9fe8ec7442efe2a1868b0e6c67e70df43ae711c06e4621df34dc2cfc67a06d149
SSDEEP
768:dFtRyOqraA2fK76wyoRzlxcVlIDZ+P/aVfpH4gCX8rlsoSx57hXvNw:dFtBqr+i76CN+IUnuF47X8CoSx57NK
Checks for missing Authenticode signature.
resource |
---|
1115863354f4ced996d602a302030ee2_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LeaveCriticalSection
EnterCriticalSection
LocalFree
MoveFileA
WritePrivateProfileStringA
GetCurrentProcessId
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
FindFirstFileA
GetShortPathNameA
GetModuleHandleA
Sleep
CreateDirectoryA
GetExitCodeProcess
WaitForSingleObject
Process32Next
Process32First
CreateThread
ExitProcess
GetCommandLineW
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
GetSystemDirectoryA
CreateProcessA
CloseHandle
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
HeapDestroy
RegQueryInfoKeyA
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
fclose
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strcmp
strncmp
strncpy
_access
_purecall
_wcslwr
wcsstr
memcpy
strlen
memcmp
??3@YAXPAX@Z
memset
sprintf
strstr
strrchr
strcat
strcpy
atoi
strchr
_stricmp
fread
??2@YAPAXI@Z
ftell
fseek
fopen
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ