DllCanUnloadNow
DllGetClassObject
Comlknc
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
220371d92cd34cf0ec93ee473c547fbc_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
220371d92cd34cf0ec93ee473c547fbc_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
220371d92cd34cf0ec93ee473c547fbc_JaffaCakes118
Size
70KB
MD5
220371d92cd34cf0ec93ee473c547fbc
SHA1
e7b9d5a2af3aae677b81c13d3aebb0a942286ba2
SHA256
02680c539d5d536419291bcf43e22dd7be0b1211a455c79383f2cd75425d3795
SHA512
fc999d1d04e7a739399229f2a2cc388a69e876c445931639e578e7b1e2b8ab786ec7c37fc26250505f7e4e84390c31cd0de7f0771c91aab8fcc20f819649b9cd
SSDEEP
1536:EXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnour:EXLwt/FiaU1Uq/dWFbNr8azD7VS372oU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
220371d92cd34cf0ec93ee473c547fbc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Comlknc
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE