DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
152991906ed8a2aa4c1a5f8af137f27a_JaffaCakes118.dll
Resource
win7-20240220-en
Target
152991906ed8a2aa4c1a5f8af137f27a_JaffaCakes118
Size
10KB
MD5
152991906ed8a2aa4c1a5f8af137f27a
SHA1
bc5fd938830eab139317028ea906ba89c5d6d882
SHA256
291d47c6bd190a64c6c626053f03522c04a8ae7e9bee44bdf8c8ed7708985f32
SHA512
b8e21d19a65f7a01a934599cee4c4a0453025d7ba4da2c609b1bfadfc31506beba8b5be20745d5a348fdff5967e2e0d8fc8ce0242d2f80ff618c9499618e280c
SSDEEP
192:NlZ7wq8MUNlPXRtolBjR+fuQt7FaNJhLkwcud2DH9VwGfctgtH:x7Xu/IlB4aNJawcudoD7U
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
152991906ed8a2aa4c1a5f8af137f27a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE