DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
19cab1d461c3c5427ae8314d3fcdc2d8_JaffaCakes118.dll
Resource
win7-20240508-en
Target
19cab1d461c3c5427ae8314d3fcdc2d8_JaffaCakes118
Size
52KB
MD5
19cab1d461c3c5427ae8314d3fcdc2d8
SHA1
77146c3b3db7f0e92dc5dabe495d182b7cc94315
SHA256
da9c7e7832434ed8b2e700ce6c4b344389ceccfa8bea9d3e528a959c41344810
SHA512
420bf9f36ac5fdfb274104b25f0eda898fe3664906aab3a8d3559548199176b2851e9b80ff6aea2339cfeea989b4c72fafab885a1558d8454443acad92cfa331
SSDEEP
1536:mXFUMatncpQuLyKe8iH3H5oyocF9pvUvFnk:mX7euAH5+ElUvFn
Checks for missing Authenticode signature.
Processes:
resource |
---|
19cab1d461c3c5427ae8314d3fcdc2d8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sleep
CreateThread
CreateDirectoryA
GetCommandLineW
WideCharToMultiByte
CloseHandle
CreateProcessA
GetSystemDirectoryA
MoveFileA
DeleteFileA
FindNextFileA
GetPrivateProfileStringA
FindFirstFileA
FreeLibrary
GetCurrentProcessId
RemoveDirectoryA
GetExitCodeProcess
WaitForSingleObject
ExitProcess
Process32Next
Process32First
WritePrivateProfileStringA
LocalFree
GetModuleFileNameA
GetModuleHandleA
GetShortPathNameA
lstrlenA
MultiByteToWideChar
lstrlenW
HeapDestroy
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetProcAddress
LoadLibraryA
SetFileAttributesA
SetNamedSecurityInfoA
SetEntriesInAclA
RegCreateKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SHGetSpecialFolderPathA
CommandLineToArgvW
CoUninitialize
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoCreateInstance
VariantClear
SysAllocString
SysStringLen
LoadRegTypeLi
SysFreeString
strcat
_stricmp
_strupr
_adjust_fdiv
malloc
_initterm
free
_wcslwr
wcsstr
strncmp
strncpy
strcpy
fopen
fseek
ftell
fread
??3@YAXPAX@Z
memcpy
_purecall
??2@YAPAXI@Z
memcmp
sprintf
strstr
memset
strlen
_access
_strlwr
atoi
strchr
strrchr
strcmp
fclose
SHSetValueA
SHDeleteValueA
SHDeleteKeyA
DllCanUnloadNow
DllGetClassObject
DllGetObjectType
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ