DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
26bda9da7a1fc2d7cc393bb2911468b8_JaffaCakes118.dll
Resource
win7-20240704-en
Target
26bda9da7a1fc2d7cc393bb2911468b8_JaffaCakes118
Size
224KB
MD5
26bda9da7a1fc2d7cc393bb2911468b8
SHA1
7d2f5e994eaab4d2b488e868782875f1cad9fe13
SHA256
2ef6917fe1b35dd3fac7047c31e8c043ce35090442ef07532d6dc71a5b33b8ee
SHA512
bc53f742861486151c631cdb900fa81639f9f79121cafb57857e584991d1dba76ee434afef1b9f9cdf38053b99ebc1f01ce51d61cbaf2e8ffccdb99f35f94cde
SSDEEP
6144:Jwx/C2G6SDG6dphYB365sryrXlsniA3Qt3:JwHG6SD/ac5sruXeiAgt
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
26bda9da7a1fc2d7cc393bb2911468b8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE