DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f4010f4298acb22ef83c23760cc197b5_JaffaCakes118.dll
Resource
win7-20240221-en
Target
f4010f4298acb22ef83c23760cc197b5_JaffaCakes118
Size
300KB
MD5
f4010f4298acb22ef83c23760cc197b5
SHA1
1fc6350e38ab84b7c62e864144fe4e7d3d67d05a
SHA256
5c2a2b520668e5cd8b6a67f7232d00de26f2a53e13abae861a4db6c44123e772
SHA512
147d70cf405f0b304dbbab536983028b689e4d71b15ebadafbba6a723c6690372b71793d0592579b7100e6e08d956d75208e4e53a9195c3e67d2a2b249f3752e
SSDEEP
6144:r/TOanBNpOYFc3I8rWeQvDItHnFT+BnMUYdkTm4E1infgxZOuRDerhvt:rKanBNo4cY/eQv0xYiUYdm7E1yth1
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f4010f4298acb22ef83c23760cc197b5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE