DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
1972a12aca81d144767296f161487b89_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1972a12aca81d144767296f161487b89_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1972a12aca81d144767296f161487b89_JaffaCakes118
Size
48KB
MD5
1972a12aca81d144767296f161487b89
SHA1
1dededf4e963a1867675a36deb16d21ba1f12de6
SHA256
f20c40531e7bbb9a67e82e2ae48499ac2a83ee9a990ddaa6612cea9629f49051
SHA512
a05b831bac3c8f5979a50339d877e5db79b7f9b40c05eeee6f69dda846cc135d1d938a92b1defc3836324ef208d65ac6c47f76e425923a7786a32013bac47ba2
SSDEEP
768:GYnL/tBtCcz4kyr5QpNRQgr7Ad+BJOJX+8PCM8kBh5hfNJOLntR5VySxAF2SvkxZ:Gi7bgcz4cpNRQw7A0BJO9/PD8KhzFJWv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
1972a12aca81d144767296f161487b89_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE