DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
e8955da41b9cb8c41e7f19d2e18dc2d4_JaffaCakes118.dll
Resource
win7-20240221-en
Target
e8955da41b9cb8c41e7f19d2e18dc2d4_JaffaCakes118
Size
10KB
MD5
e8955da41b9cb8c41e7f19d2e18dc2d4
SHA1
9615dd7b7b2bc483fd0005d3758ee98ff672b361
SHA256
7f93aa61fc39827a7093bbae945417bbcbc785312b30b6ca58013809a4a86a63
SHA512
b4041248058762963919dd3eac13c238b5b8cce85a4eeb1ef837907f5e2d58cb1332b0ec2ebe3614a94a39b814dabf0343760cfc012adce2a5fc451fb3f51367
SSDEEP
192:QGsPmi0fGYwP/LqtP2HbCoGluSYwUSFaNJhLkwcud2DH9VwGfct7L:eu5W2tWB0P9aNJawcudoD7U
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e8955da41b9cb8c41e7f19d2e18dc2d4_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE