DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
25498410fbb1bad1faccab8c00d93e53_JaffaCakes118.dll
Resource
win7-20240708-en
Target
25498410fbb1bad1faccab8c00d93e53_JaffaCakes118
Size
72KB
MD5
25498410fbb1bad1faccab8c00d93e53
SHA1
824e85bf98313b74b5663c0e4db4bcaba592ea2c
SHA256
7d061a604a3a87cdaeee3429233a89a714c81c7e9dcac01aa2e699f80f0f788a
SHA512
a6b51d7e940487e4a45800784e95b712c705168cad4bd38e49052e8c5f442dae0b09642c60e00bf2f1b7b5361ca14a21908f7373616c6265a08ba655e9aa1416
SSDEEP
1536:tHUyslGZPKAIIgEAfPjyu3ceihKesEzkbp3RPj:tHUflGZPpIIWni2Ekp3Zj
Checks for missing Authenticode signature.
resource |
---|
25498410fbb1bad1faccab8c00d93e53_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
Process32Next
Process32First
CreateDirectoryA
DeleteFileA
WritePrivateProfileStringA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
CreateThread
LocalFree
GetPrivateProfileStringA
FindFirstFileA
RemoveDirectoryA
FreeLibrary
WideCharToMultiByte
MoveFileA
SetFileAttributesA
GetCurrentProcessId
GetCommandLineW
ExitProcess
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
CloseHandle
GetProcAddress
LoadLibraryA
FindNextFileA
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memcmp
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
strcmp
_wcslwr
wcsstr
atoi
strrchr
fopen
fseek
ftell
fread
strstr
??3@YAXPAX@Z
sprintf
strlen
memset
strcat
strcpy
memcpy
_purecall
??2@YAPAXI@Z
_strupr
strncpy
strchr
strncmp
_access
fclose
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ