DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
25474e7654c80782bedb71ca9515254a_JaffaCakes118.dll
Resource
win7-20240508-en
Target
25474e7654c80782bedb71ca9515254a_JaffaCakes118
Size
228KB
MD5
25474e7654c80782bedb71ca9515254a
SHA1
4f9fadb88d5cf17012511125f64e8a49dd150b68
SHA256
059d94455d3a63f2bfaa0ff340cc2e2f6d454f59dbde963b58b9fb16f63ca00d
SHA512
e6387ee7a708882659058230f30741a76fd8ba9aace8de2e6dbcc4102e06708fcbec198407910a91d9e79ad810babc93309dfa0d2b425c816e76382bdcefeaa9
SSDEEP
6144:nO6JWtWrR0X0g6utSSRJUTf4tTIU/yFW6FU:nOFtYRm0StJDUj4toF
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
25474e7654c80782bedb71ca9515254a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE