DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
41aa4e211c403a9db2d118c5f1d6f46c_JaffaCakes118.dll
Resource
win7-20240903-en
Target
41aa4e211c403a9db2d118c5f1d6f46c_JaffaCakes118
Size
52KB
MD5
41aa4e211c403a9db2d118c5f1d6f46c
SHA1
25ecf36a8a0c59f87234401ddaf411a991541341
SHA256
ad155c9eca6284bed7c76714e50b4b0ad847cdc859798130844b16eb099d4e7c
SHA512
5170f48ec0f700cfa3cb3fccc02366904ec0ea6e2fdf8b29b5e1dd5f178493d228833f4f4fbab719de8cabea7605bcae17dfd345e181f93c1e1b45ff0581e0b4
SSDEEP
1536:Y1cl6fE9Qp2AA5HEPQZDll5Xw3kGbRJUZ6O6HkZme:YMDll5XMV+ZF6EN
Checks for missing Authenticode signature.
resource |
---|
41aa4e211c403a9db2d118c5f1d6f46c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
RemoveDirectoryA
GetSystemDirectoryA
GetCommandLineW
MultiByteToWideChar
lstrlenA
lstrlenW
WideCharToMultiByte
GetExitCodeProcess
WaitForSingleObject
CreateThread
SetFileAttributesA
CreateProcessA
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
HeapDestroy
GetShortPathNameA
GetModuleHandleA
GetCurrentProcessId
ExitProcess
MoveFileA
GetProcAddress
CreateDirectoryA
WritePrivateProfileStringA
LocalFree
Process32First
Process32Next
CloseHandle
FindFirstFileA
GetPrivateProfileStringA
DeleteFileA
FindNextFileA
GetModuleFileNameA
LoadLibraryA
Sleep
FreeLibrary
DisableThreadLibraryCalls
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegQueryValueExA
RegOpenKeyExA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoGetInterfaceAndReleaseStream
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize
SysStringLen
LoadRegTypeLi
SysAllocString
VariantClear
SysFreeString
memset
_strupr
_stricmp
_adjust_fdiv
malloc
_initterm
free
fopen
fseek
ftell
fread
fclose
??2@YAPAXI@Z
_purecall
_wcslwr
wcsstr
??3@YAXPAX@Z
strcmp
strrchr
strstr
sprintf
strcpy
atoi
strchr
_access
strcat
_strlwr
strncpy
strncmp
strlen
memcmp
memcpy
SHSetValueA
SHDeleteKeyA
SHDeleteValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ