DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3ba948259c65c463677f5c1c4bfece4e_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3ba948259c65c463677f5c1c4bfece4e_JaffaCakes118
Size
52KB
MD5
3ba948259c65c463677f5c1c4bfece4e
SHA1
99edaa94d356f3ea871cb0a30a21d55f81dea72c
SHA256
d4d6d243b2c40dbd87d947d5d74a9dca0a668d5568827f88465031bf59426aa3
SHA512
d2407629abec24e29ecda59851abf5249d1e863ed3f480479be82e88604dffef088f3d8a9693daa304b6f7e6fe24452d8d5ddb958ed57c10083bf669998c0dc7
SSDEEP
1536:BkcIP+KHa5qGjKPuPjm6U17jmY71Spslvc+iRO/9+Xw2eH5C:BkDejKPRmYBDAROMXw2ek
Checks for missing Authenticode signature.
resource |
---|
3ba948259c65c463677f5c1c4bfece4e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetModuleFileNameA
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
CreateThread
LocalFree
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
Process32Next
Process32First
GetCommandLineW
RemoveDirectoryA
WritePrivateProfileStringA
ExitProcess
FreeLibrary
CreateDirectoryA
LoadLibraryA
GetProcAddress
lstrlenW
WideCharToMultiByte
SetFileAttributesA
MoveFileA
lstrlenA
MultiByteToWideChar
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetCurrentProcessId
Sleep
EnterCriticalSection
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoInitialize
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysFreeString
SysAllocString
VariantClear
_access
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
atoi
fopen
fseek
ftell
fread
fclose
strcmp
sprintf
strncpy
strchr
memset
strncmp
strlen
strcpy
strstr
strrchr
??3@YAXPAX@Z
_strupr
strcat
memcmp
memcpy
_purecall
??2@YAPAXI@Z
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ