DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
211a64e3c1d647560c7bd3005ec4969a_JaffaCakes118.dll
Resource
win7-20240508-en
Target
211a64e3c1d647560c7bd3005ec4969a_JaffaCakes118
Size
270KB
MD5
211a64e3c1d647560c7bd3005ec4969a
SHA1
d550a124cf50e2e1d6490fd2283db6a1a666a643
SHA256
793e210d2cd81a67925783c49af9d470ed68de545a2a4853d3c91520aecde760
SHA512
5ad7ef2cd69817a9cfebc0d36c1d1527b25a213d6a87884a58b8e1fa2fa7b1c1953f325b669bc97255c300b104e8a2694891eeb7c6844dd7d1cef8238b1ef08c
SSDEEP
6144:xEXyeh1fKZfY+/vVevqEbZ0GMuDbnhkBGhkEXmRE:xSyevfKZfY+1evpZkuDb2khJX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
211a64e3c1d647560c7bd3005ec4969a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE