DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
0e1cdd316c1d11dc08d01e9707ba6b3f_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0e1cdd316c1d11dc08d01e9707ba6b3f_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
0e1cdd316c1d11dc08d01e9707ba6b3f_JaffaCakes118
Size
344KB
MD5
0e1cdd316c1d11dc08d01e9707ba6b3f
SHA1
abdbb78d48082fe5094ece83d846aaddc963ca99
SHA256
6f88214e329721e0da554d4ea78e46ebf7bb06b0fa8cdd1bd8cc3b8f70472d7e
SHA512
e97f7764db2f67d6145c63ae7a76fc70aae7802618d708c556db7db4d4bd44052666eafe0fef8125e500133e1102f18009ac452b419fe8532543ec72a08c3e1a
SSDEEP
6144:42hdGHBSCbl0J0ikRuaAeNqQGdq9+spw7fbu1TUFHu06kGasRvgd66ETUok:4wCbKJQGdq9+MIqUP6kGasR+66EThk
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0e1cdd316c1d11dc08d01e9707ba6b3f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE