DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3ba0ab2a1d079ebe26bbf58aca742cc8_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3ba0ab2a1d079ebe26bbf58aca742cc8_JaffaCakes118
Size
64KB
MD5
3ba0ab2a1d079ebe26bbf58aca742cc8
SHA1
3f90760df235dcb499d8efe6b3c9c88aa7cae854
SHA256
76e5e7a42c1f38701a20aef6939ed0ddc78eb7804b8dc724dce01e1dd4ba2084
SHA512
c762cf2898a2af41a3cc86e22b042eac074a1f90096274dc14053a3ff804a3fa3f10b061d427a72ac7cf384ab57bfb55e3bbe34e98962e7a09b62486a4ed003c
SSDEEP
768:gxl6Iyu0+e7mVduNONhFQPt2V7aj8KaKeSmK90+1lehWZQrSlf7Zf4rdiVCbNSIs:g76yhVYN0jQlp8HNSmmp0geWuceIzw
Checks for missing Authenticode signature.
resource |
---|
3ba0ab2a1d079ebe26bbf58aca742cc8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
lstrlenA
ExitProcess
MoveFileA
Process32Next
Process32First
RemoveDirectoryA
FreeLibrary
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
GetProcAddress
MultiByteToWideChar
lstrlenW
Sleep
CreateThread
CreateDirectoryA
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
FindFirstFileA
GetPrivateProfileStringA
SetFileAttributesA
DeleteFileA
FindNextFileA
WaitForSingleObject
GetExitCodeProcess
WritePrivateProfileStringA
LocalFree
GetSystemDirectoryA
CreateProcessA
CloseHandle
GetCurrentProcessId
GetModuleFileNameA
GetCommandLineW
WideCharToMultiByte
BuildExplicitAccessWithNameA
RegDeleteKeyA
SetEntriesInAclA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
strcat
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
_purecall
strncmp
strncpy
memcpy
strcmp
memcmp
fopen
fseek
ftell
memset
strlen
sprintf
??3@YAXPAX@Z
strstr
wcsstr
_wcslwr
atoi
strchr
strrchr
_strupr
strcpy
_access
??2@YAPAXI@Z
fclose
fread
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ