DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
304014720d03112d37f4076d3b1cf021_JaffaCakes118.dll
Resource
win7-20240705-en
Target
304014720d03112d37f4076d3b1cf021_JaffaCakes118
Size
228KB
MD5
304014720d03112d37f4076d3b1cf021
SHA1
a48fa781e4dd38c80f3972563cbb95f514a2ad65
SHA256
bc037fd297e375104731c4efe534cfc42cdb3a0303a383c6edb2190a3ed16e89
SHA512
bc2260c0351ac7137f94f2a7d94f04a8a0aa26c879ac4c3867ce796f91463f2c5239e619ae8c6390c465696dc6d702466f57f86fd031469a1834719b63f216e0
SSDEEP
6144:+BG0qLgLy99votEg1GGhsbol+4ymMsGyYYk:+BG0qsLynOEggGhPlNymvGzV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
304014720d03112d37f4076d3b1cf021_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE