DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
39786a2a71c17717b29d085ce2b952c5_JaffaCakes118.dll
Resource
win7-20240903-en
Target
39786a2a71c17717b29d085ce2b952c5_JaffaCakes118
Size
56KB
MD5
39786a2a71c17717b29d085ce2b952c5
SHA1
a45f5e154b65e9c34a5d582309a171ac538ceb07
SHA256
11e47cecf1faa1c7ed18953ce9820d8823a70fead9d736388b11bf7fa1296107
SHA512
56b3dcb61a01ceb9c6828260a2bd67476b19b5f831547b8c2293a23fd73955d6ce356dcd75e7388985e55522324872e6add43b406a58b6f72585cac7e0b6716c
SSDEEP
1536:PLvqeVSeR/HcgkCWxMgnOLSvF/Axh9wH9Tdv:PLvfMedcgEugnfUmH9Tdv
Checks for missing Authenticode signature.
resource |
---|
39786a2a71c17717b29d085ce2b952c5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
LocalFree
CreateThread
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
DeleteFileA
WideCharToMultiByte
GetProcAddress
SetFileAttributesA
CreateDirectoryA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
GetCurrentProcessId
GetCommandLineW
MoveFileA
Process32Next
Process32First
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenW
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
lstrlenA
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
FreeLibrary
ExitProcess
WritePrivateProfileStringA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
strcmp
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strncmp
strncpy
_access
fopen
fseek
ftell
fread
fclose
strcpy
??3@YAXPAX@Z
sprintf
atoi
strchr
memcpy
_purecall
??2@YAPAXI@Z
memcmp
wcsstr
_wcslwr
_stricmp
strrchr
strlen
strstr
memset
strcat
SHDeleteValueA
SHSetValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ