DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f7806b08123a9d29462c801cae7bcd4a_JaffaCakes118.dll
Resource
win7-20240221-en
Target
f7806b08123a9d29462c801cae7bcd4a_JaffaCakes118
Size
224KB
MD5
f7806b08123a9d29462c801cae7bcd4a
SHA1
056c49997d90827665604cb432aa8fb042e88a79
SHA256
e33d963629e03ab2d71ed6bb7e5a9dbbd323c9b4ac2ac2a7657997b978c66a23
SHA512
381252a015bf48d32036bf8f81dc70ed828dec7e8c3e569a4cbc45d6cc20c746f1305432e044bed0ba068f4b44b300b256c0b9d904e54275221ea880a8bdd9ab
SSDEEP
6144:TQ2D2jiXna6yh90bJTeLegwVaTXZvwhf0QN:TzD2ji3HReLtOKZ+0Q
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f7806b08123a9d29462c801cae7bcd4a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE