DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
16d500bc9ccdbff2d31a2a0e4fc9a072_JaffaCakes118.dll
Resource
win7-20240611-en
Target
16d500bc9ccdbff2d31a2a0e4fc9a072_JaffaCakes118
Size
320KB
MD5
16d500bc9ccdbff2d31a2a0e4fc9a072
SHA1
302a41992811fbfe3947b964d799e549c9fd3225
SHA256
5584faf811ac9c98ff5c6a61068e7fe5668cef48be84080f57c408c88328798c
SHA512
43ea4aeae50f20bfbda9f1da2d089f811cf8ee05061445c109e09485130ead13b143331126eae03654d2e67f43c16628cc46d0f0769c990cc2367bab75f4b372
SSDEEP
6144:rMvp1ZjeV4p/uyb88yHRsP96b1GGjwqPE+wJA9QvIIzSIvPFZtGmoS:rMvp1leVKbx16b1GGctI6/nGmoS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
16d500bc9ccdbff2d31a2a0e4fc9a072_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE