DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
31106a27cc76b962088eda0b0cf3a397_JaffaCakes118.dll
Resource
win7-20240903-en
Target
31106a27cc76b962088eda0b0cf3a397_JaffaCakes118
Size
68KB
MD5
31106a27cc76b962088eda0b0cf3a397
SHA1
17f6728e774f42510bff174215918b56e0bff3b2
SHA256
c92a6d376fc5bd5d3ccf55d5b90cac754547f15844a794fdbe94ca8de037f112
SHA512
efcd2d97b4068b3cdbff796768d60f0798bc10ef7d5a6577f77f20cf0e18bf4113e7da1ae6ce6232a3abfe291c8931022db7db90874ca8361ef8ea73cf231c86
SSDEEP
1536:tCpcaVu4bbiyxclzD93olWiIwnPzQK6wsUJ/nnWGxn:ucO7ISzQBwzJ/nWGx
Checks for missing Authenticode signature.
resource |
---|
31106a27cc76b962088eda0b0cf3a397_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
lstrlenW
GetShortPathNameA
GetModuleHandleA
Sleep
WideCharToMultiByte
GetProcAddress
DeleteCriticalSection
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
Process32Next
Process32First
GetCommandLineW
GetExitCodeProcess
WaitForSingleObject
RemoveDirectoryA
WritePrivateProfileStringA
InitializeCriticalSection
DisableThreadLibraryCalls
CreateThread
DeleteFileA
MoveFileA
CreateDirectoryA
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
CloseHandle
ExitProcess
SetFileAttributesA
lstrlenA
MultiByteToWideChar
LoadLibraryA
LocalFree
FreeLibrary
GetCurrentProcessId
RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
_wcslwr
_strupr
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
strcpy
strncmp
strncpy
strrchr
memset
??3@YAXPAX@Z
atoi
strchr
sprintf
strstr
_access
strcat
strlen
wcsstr
_stricmp
memcpy
_purecall
??2@YAPAXI@Z
memcmp
strcmp
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ