DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
0e166b040a087e7cc158eae53bebff56_JaffaCakes118.dll
Resource
win7-20240611-en
Target
0e166b040a087e7cc158eae53bebff56_JaffaCakes118
Size
234KB
MD5
0e166b040a087e7cc158eae53bebff56
SHA1
aa020f6e857a368e5a6a4b58b0efe636bc8580e8
SHA256
c103ed619154a11eb2a45b08dde983e1a145ee3463796aeda8959c4fd866b2e6
SHA512
108461f784b2bb50a577dc0b7bd15b763ed15714e519f6747ab429fe9d125c67f00fc3a6eb8e90197669aaeebcb6da3f54dd3b1212dc22bf71ca5f569bae64a3
SSDEEP
6144:Pahv75iH71UHwTgvOKg+wgUNnmHb1p1ZRSBhNcAUH5:+75ib1UQg2SwgZRZOhNcHH5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0e166b040a087e7cc158eae53bebff56_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE