DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3dc80de442c5f67aa22241304d6edad4_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3dc80de442c5f67aa22241304d6edad4_JaffaCakes118
Size
52KB
MD5
3dc80de442c5f67aa22241304d6edad4
SHA1
dccbc10951e9d2c751984e2d068075b537a36da2
SHA256
c5b9d4b79e25d53c16b1f12bd94713699b4835807e5ab50a8ace5ca5f1f9455d
SHA512
c920ee22af41a81ffb3c6f78a1e7caed19635727c40bf230bccf31efef285d1b560e3185da67ba3efc1da0076404145803ded875cd21cb348dac42c7385d0647
SSDEEP
768:HyHh+tr0XH5JoHZSnpZt9ORXP6ZY4nzt8i4sXjVRBo3p//CHWg4BuoHptDz:shi0XZJGwpBQGnzOUpRG3pn0doHvD
Checks for missing Authenticode signature.
resource |
---|
3dc80de442c5f67aa22241304d6edad4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
InterlockedIncrement
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
MoveFileA
DeleteFileA
SetFileAttributesA
ExitProcess
GetExitCodeProcess
CloseHandle
WaitForSingleObject
CreateProcessA
DeleteCriticalSection
CreateThread
Process32Next
Process32First
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
LocalFree
CreateDirectoryA
GetCommandLineW
InitializeCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameA
WideCharToMultiByte
lstrlenW
GetCurrentProcessId
WritePrivateProfileStringA
Sleep
lstrlenA
MultiByteToWideChar
FreeLibrary
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
SetEntriesInAclA
SetNamedSecurityInfoA
OpenSCManagerA
OpenServiceA
ControlService
DeleteService
CloseServiceHandle
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
memset
_stricmp
_strlwr
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_access
strcmp
strcat
_wcslwr
??3@YAXPAX@Z
strstr
sprintf
??2@YAPAXI@Z
memcmp
memcpy
strlen
_purecall
strncpy
strchr
_strupr
strncmp
strcpy
atoi
strrchr
wcsstr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ