DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
26bf4395e63cc50152ac9180785b11a8_JaffaCakes118.dll
Resource
win7-20240903-en
Target
26bf4395e63cc50152ac9180785b11a8_JaffaCakes118
Size
52KB
MD5
26bf4395e63cc50152ac9180785b11a8
SHA1
8dcd7f486e84b1dcdfba51d61ae4cc9a1bf81be3
SHA256
7d46ac7819f0d7c0ae5893dbec25aeaf8e4cf5bc691efc3141988ae08fd4e69f
SHA512
bf2f9dbdb1ea478560d7202c74a6bea2a8f6c70e9b570b2bea19936fbe45ebab9adcb8914c11cc768e3f4126fd371c79581fb0e08977a400c8501c82c59ea329
SSDEEP
768:Ocltjn5fUMCF4RFjlzK2I5HZQS4N8rS5hs1M4HrGOfp474uAYSYVsi3TY7yE9wg8:O8fUARXKBlVbu5S1ZH90lpjMy8eVRQE
Checks for missing Authenticode signature.
resource |
---|
26bf4395e63cc50152ac9180785b11a8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
lstrlenA
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
Sleep
WritePrivateProfileStringA
WideCharToMultiByte
CreateDirectoryA
ExitProcess
InterlockedIncrement
CreateProcessA
GetSystemDirectoryA
GetCommandLineW
CreateThread
GetCurrentProcessId
GetExitCodeProcess
WaitForSingleObject
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
Process32First
Process32Next
CloseHandle
FindFirstFileA
GetPrivateProfileStringA
FindNextFileA
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
LoadLibraryA
LocalFree
FreeLibrary
GetProcAddress
DeleteService
ControlService
CloseServiceHandle
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
OpenSCManagerA
OpenServiceA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
wcsstr
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
_access
strncmp
strncpy
strcat
fopen
fseek
ftell
fread
memset
atoi
strchr
??3@YAXPAX@Z
sprintf
strlen
strstr
strrchr
strcpy
_strupr
_wcslwr
memcpy
_purecall
??2@YAPAXI@Z
memcmp
fclose
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ