DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
0b35c11bebf1ddef9dc787ae6be58931_JaffaCakes118.dll
Resource
win7-20240221-en
Target
0b35c11bebf1ddef9dc787ae6be58931_JaffaCakes118
Size
234KB
MD5
0b35c11bebf1ddef9dc787ae6be58931
SHA1
0bba12b94e632b4a240fbf5ce36eb3d150b5fdef
SHA256
2d8ff335d48bb084b4a2b7dd0f36e99bbb82b48a40589969584340dfaba48b88
SHA512
aca07e678dbefbcb16aac13a9d7a93b3c28435a4513a2908e8ca9df666f2c2f4123f1d041a023f9358b7cd662e7cecf18f161f893f2a50b361f33ec5c2fa471a
SSDEEP
6144:jahv75iH71UHwTgvOKg+wgUNnmHb1p1ZRSTdD2rvypK21:q75ib1UQg2SwgZRZPrVW
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0b35c11bebf1ddef9dc787ae6be58931_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE