DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
2e8e90676a7020100d328ae32598af10_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2e8e90676a7020100d328ae32598af10_JaffaCakes118
Size
60KB
MD5
2e8e90676a7020100d328ae32598af10
SHA1
f33bb5566826cbad54a8ee80fdfea3fe09a89426
SHA256
3127b0fdf32ccec3e9a7189dc6aee83a0ae41ce6faefab42c8ba7f5687c629f8
SHA512
166bfc46ad4ea573dff252f51f1e39abc7fe0aaf08a9fbaf0bbfa853ca05d3455fdd702021c3cb427b69c30a0bcbf527b4e8addd32ae219bcba63cdd4dbf890f
SSDEEP
768:FwUso7ZcXqBFJmjBHpcuIXhrxF7CRFoQBO8U0Fia/9PyJU5fSHoNCtBSq4tbk/:Fn2aViv320RdBfpry5I6Stbk
Checks for missing Authenticode signature.
resource |
---|
2e8e90676a7020100d328ae32598af10_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
FreeLibrary
GetProcAddress
LoadLibraryA
WideCharToMultiByte
CloseHandle
Sleep
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
GetModuleHandleA
DeleteFileA
SetFileAttributesA
GetPrivateProfileStringA
FindFirstFileA
Process32Next
Process32First
ExitProcess
MoveFileA
CreateThread
CreateDirectoryA
GetCommandLineW
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
LocalFree
WritePrivateProfileStringA
GetModuleFileNameA
FindNextFileA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCloseKey
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memset
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_access
fopen
fseek
ftell
fread
fclose
strchr
strcmp
strrchr
??3@YAXPAX@Z
sprintf
memcpy
_purecall
??2@YAPAXI@Z
memcmp
wcsstr
_wcslwr
_strlwr
strlen
strcat
strcpy
strstr
atoi
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ