DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
445eda87245f59fd406a1418a3a07f3f_JaffaCakes118.dll
Resource
win7-20240903-en
Target
445eda87245f59fd406a1418a3a07f3f_JaffaCakes118
Size
72KB
MD5
445eda87245f59fd406a1418a3a07f3f
SHA1
c7c0f0799b04b68e7af4c4e0d4dea09893ef6c75
SHA256
b4b08ef635b37b32838e89ada1ea360b036701d0de4846dec7ee214fd270295d
SHA512
530af248d69c040b4a4588df2153cf20fc5b8707738aa8191e4ad245b8e1df193a67914e26415cbb08691e0ab2bceb97f1006dc4b034c866cd96bde47a9996ce
SSDEEP
1536:JNaAVTmp7TpJTdIuXCC7/nvQGrpvrJnz:KHIuv7/nrp9z
Checks for missing Authenticode signature.
resource |
---|
445eda87245f59fd406a1418a3a07f3f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Process32Next
Process32First
Sleep
CreateDirectoryA
RemoveDirectoryA
WritePrivateProfileStringA
LocalFree
GetProcAddress
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
FindFirstFileA
InterlockedDecrement
HeapDestroy
lstrlenW
lstrlenA
GetShortPathNameA
GetModuleHandleA
WideCharToMultiByte
CreateThread
GetPrivateProfileStringA
FindNextFileA
LoadLibraryA
FreeLibrary
GetCurrentProcessId
ExitProcess
MultiByteToWideChar
SetFileAttributesA
DeleteFileA
MoveFileA
GetCommandLineW
GetSystemDirectoryA
GetModuleFileNameA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
CloseHandle
EnterCriticalSection
RegCreateKeyExA
RegEnumKeyExA
RegSetValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetEntriesInAclA
SetNamedSecurityInfoA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegDeleteKeyA
CommandLineToArgvW
SHGetSpecialFolderPathA
CoInitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoCreateInstance
SysAllocString
VariantClear
SysStringLen
LoadRegTypeLi
SysFreeString
fread
_strlwr
_stricmp
_adjust_fdiv
malloc
_initterm
free
atoi
memcmp
_purecall
memcpy
strncmp
strchr
strncpy
strcmp
_wcslwr
memset
sprintf
strlen
??3@YAXPAX@Z
strstr
strrchr
strcpy
strcat
_access
fclose
_strupr
??2@YAPAXI@Z
ftell
fseek
fopen
wcsstr
SHDeleteValueA
SHDeleteKeyA
SHSetValueA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ