DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
408cfc469406d4daf48fc7b38eebafb0_JaffaCakes118.dll
Resource
win7-20240903-en
Target
408cfc469406d4daf48fc7b38eebafb0_JaffaCakes118
Size
72KB
MD5
408cfc469406d4daf48fc7b38eebafb0
SHA1
e140b15d37b5bbdd57bf0d422ba8999b581f189a
SHA256
9b10f6b35af481be6251538d4387a1dfb36fe313a930ed6c20ea55932555d25d
SHA512
0b7a9179c977313a621fe54992113c2e5ae599ec355295cbe63c0e936fd3725e3308e5bcc0aafcac443c2fce1a2bf8aabdc76293fd317ed7c6741bd36ebaa6c9
SSDEEP
1536:84K8JbCbvbP0uY9MDXPIlAAKcsZz5buVQXSN:8LQubLY9MD/0A7CVQXSN
Checks for missing Authenticode signature.
resource |
---|
408cfc469406d4daf48fc7b38eebafb0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetCurrentProcessId
FreeLibrary
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
MultiByteToWideChar
lstrlenA
GetShortPathNameA
SetFileAttributesA
CreateThread
Sleep
LocalFree
ExitProcess
RemoveDirectoryA
WritePrivateProfileStringA
MoveFileA
CreateDirectoryA
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
lstrlenW
WideCharToMultiByte
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
GetCommandLineW
LoadLibraryA
GetProcAddress
Process32First
CloseHandle
Process32Next
GetModuleHandleA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
SetEntriesInAclA
SetNamedSecurityInfoA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitialize
CoUninitialize
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
memcpy
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
_wcslwr
wcsstr
_access
strcmp
strcpy
??3@YAXPAX@Z
memset
sprintf
strlen
atoi
strchr
strstr
strrchr
strcat
_strupr
_purecall
??2@YAPAXI@Z
memcmp
strncpy
strncmp
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ