DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
2605e084c0ce62b05e2abb484424d205_JaffaCakes118.dll
Resource
win7-20240708-en
Target
2605e084c0ce62b05e2abb484424d205_JaffaCakes118
Size
68KB
MD5
2605e084c0ce62b05e2abb484424d205
SHA1
f42ccf6db3111aca72801b819c26705318aa87f1
SHA256
7b38fbe59af0a07adbfa6f0b0f5841778353aebe0749617ee79a6c5cdf8a7155
SHA512
7eb70cb4b366784f4b2f64b1ea9a6f166e84de64529e675f5f601a96df9c4a377cb2428a9c173e0d3d0304750c06459e77cc203e9045248bfa84911aa622f74f
SSDEEP
768:JtEvlRgF129lQVMiV+woyjZT+iNc6N2JYBk4AgGBqLMqbeM/Nwx/yCzishMRi0t:JFMcsAYR6COFAbBqwqbjKx3zZ0i0t
Checks for missing Authenticode signature.
resource |
---|
2605e084c0ce62b05e2abb484424d205_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32First
CreateDirectoryA
WritePrivateProfileStringA
Sleep
MoveFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetCommandLineW
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
Process32Next
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
RemoveDirectoryA
ExitProcess
GetCurrentProcessId
CreateThread
CloseHandle
GetModuleFileNameA
lstrlenW
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
LocalFree
SetFileAttributesA
LeaveCriticalSection
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegEnumKeyExA
RegDeleteKeyA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
VariantClear
SysAllocString
SysFreeString
strlen
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
_wcslwr
wcsstr
atoi
fopen
fseek
ftell
fread
fclose
strstr
??3@YAXPAX@Z
strrchr
sprintf
memcmp
strcpy
_access
strcat
memcpy
memset
_strupr
_purecall
??2@YAPAXI@Z
strncpy
strchr
strncmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ