DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MsgHookOk
MsgHookOn
Behavioral task
behavioral1
Sample
30dc4effd487dabe74006f117ca89f18_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30dc4effd487dabe74006f117ca89f18_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
30dc4effd487dabe74006f117ca89f18_JaffaCakes118
Size
23KB
MD5
30dc4effd487dabe74006f117ca89f18
SHA1
25e606818c17141bcbd778e292ac8ab772034cdf
SHA256
605922afb0e69b13199cb710e2ea2e30628db4fda77842033d3dfcb104a75e15
SHA512
14bf359b9d507d6bace3e01f133cde274cfa3a165228516fe3323e1b999ec71f89410316441e1908209879bce989233844cc342415b0e4272558f95ec7749720
SSDEEP
384:mcxHRaFojkyz5k4jrM9GBLSg6hXkDmWBfckVN4R8dxsqACH:zHvkyz5x0AJbYuG8uqn
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
30dc4effd487dabe74006f117ca89f18_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MsgHookOk
MsgHookOn
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE