DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
17ff246d19deed8d407ed9540d2a32e6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
17ff246d19deed8d407ed9540d2a32e6_JaffaCakes118
Size
52KB
MD5
17ff246d19deed8d407ed9540d2a32e6
SHA1
c53e72de9602c8d30f39334a3f3275e832086751
SHA256
9c0185aa5d445e8b84eebf4db4aadd7f2c8dcb3fdb0b6c205e816bb1ffbdb6ff
SHA512
d7f35aedc145ad0c473b857a24807788b35bf70e093f16f7dcbfaf533d8dd3eacd04c4e61ea6fb4192dc96fb1a72c67e22afd3bb81f3f4c1f8ed2ec03d550db2
SSDEEP
1536:wHjpOuf5TiTlBkqgDMMzdjIKt47q63yXSD:MgufWlB3gNpwb3yX
Checks for missing Authenticode signature.
resource |
---|
17ff246d19deed8d407ed9540d2a32e6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CloseHandle
CreateProcessA
GetSystemDirectoryA
FindNextFileA
DeleteFileA
GetPrivateProfileStringA
FindFirstFileA
Sleep
CreateThread
GetProcAddress
GetCommandLineW
CreateDirectoryA
WideCharToMultiByte
LoadLibraryA
SetFileAttributesA
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
Process32Next
Process32First
LocalFree
FreeLibrary
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WritePrivateProfileStringA
DisableThreadLibraryCalls
MoveFileA
SetNamedSecurityInfoA
SetEntriesInAclA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoInitialize
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
strstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
atoi
fopen
fseek
ftell
fread
fclose
_access
strcmp
strcat
sprintf
memcpy
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
memcmp
memset
wcsstr
_wcslwr
_strupr
strrchr
strncpy
strchr
strncmp
strlen
strcpy
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ