DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
3ee1e17538970e39b9c9c7c091390b52_JaffaCakes118.dll
Resource
win7-20240729-en
Target
3ee1e17538970e39b9c9c7c091390b52_JaffaCakes118
Size
60KB
MD5
3ee1e17538970e39b9c9c7c091390b52
SHA1
41647957632e3dda1d542870a71d2f51eab0db2f
SHA256
bbe9c4562e62b4e9d6f77c8ddc740a92971a74d5c792f5f4d12245528251020e
SHA512
5d55c2a276d360962d944194c6f866f32fd3c74dc12ae474748a9dbc746dd6c02b3ef44156d7cc1aeced9b803ff273a6370d1c2913e1132a8dc1d44d27f17b66
SSDEEP
1536:lpA2dAM/EGoJ8qut/lsjDN+b/gvacYq1:XA2dr/GE/lsjDN+bxcYs
Checks for missing Authenticode signature.
resource |
---|
3ee1e17538970e39b9c9c7c091390b52_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DeleteFileA
CloseHandle
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
CreateProcessA
RemoveDirectoryA
WritePrivateProfileStringA
SetFileAttributesA
FreeLibrary
LoadLibraryA
GetCurrentProcessId
GetSystemDirectoryA
GetModuleFileNameA
Process32Next
Process32First
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
ExitProcess
GetCommandLineW
MoveFileA
CreateThread
CreateDirectoryA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
Sleep
LocalFree
WideCharToMultiByte
SetNamedSecurityInfoA
GetNamedSecurityInfoA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
BuildExplicitAccessWithNameA
SetEntriesInAclA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strchr
_strlwr
_strupr
_adjust_fdiv
malloc
_initterm
free
strcmp
atoi
_access
strrchr
strcat
fopen
fseek
ftell
fread
??3@YAXPAX@Z
wcsstr
_wcslwr
memcpy
_purecall
??2@YAPAXI@Z
memcmp
sprintf
strstr
strncpy
_stricmp
memset
strncmp
strlen
strcpy
fclose
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ