DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
15b4cae1d8ad5f8f53889eb250a49797_JaffaCakes118.dll
Resource
win7-20240729-en
Target
15b4cae1d8ad5f8f53889eb250a49797_JaffaCakes118
Size
64KB
MD5
15b4cae1d8ad5f8f53889eb250a49797
SHA1
28fe33577c90bad3668164b5f69ab94cf35c78e3
SHA256
e230d095bed295917494fcb893d8334010aac02bf5b29d43a45c7b1734da6e66
SHA512
44acd4a61338b466d229e6a2168f795e3321600c008a0ee27afd8abcae889c5b9475087ba5c48c9b4d6d609f8dd00291dba23c7dc7490f320dc0de24206cd42c
SSDEEP
768:k54fonhJmtyHhxK/NzgDPZNyrTZAxbg+s7txO1GDHGwxLJVF6kZ0AReqf24+FbGX:kmfonhJkyHiaDENce5FxZVbfHYbyNV
Checks for missing Authenticode signature.
resource |
---|
15b4cae1d8ad5f8f53889eb250a49797_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenW
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetModuleFileNameA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
CreateDirectoryA
GetModuleHandleA
GetExitCodeProcess
CloseHandle
WaitForSingleObject
GetSystemDirectoryA
Sleep
Process32Next
Process32First
MoveFileA
ExitProcess
GetProcAddress
GetCurrentProcessId
CreateThread
RemoveDirectoryA
CreateProcessA
GetCommandLineW
WritePrivateProfileStringA
LoadLibraryA
FreeLibrary
LocalFree
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
LeaveCriticalSection
EnterCriticalSection
GetShortPathNameA
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegDeleteKeyA
RegQueryInfoKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
VariantClear
SysStringLen
LoadRegTypeLi
SysAllocString
SysFreeString
fseek
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
_wcslwr
wcsstr
strlen
strncmp
strchr
strncpy
_purecall
??3@YAXPAX@Z
strstr
memset
strrchr
sprintf
strcat
fclose
fread
??2@YAPAXI@Z
ftell
_stricmp
fopen
strcpy
_access
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ