DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
34864aff20a32fc630075bfd425bd013_JaffaCakes118.dll
Resource
win7-20240705-en
Target
34864aff20a32fc630075bfd425bd013_JaffaCakes118
Size
549KB
MD5
34864aff20a32fc630075bfd425bd013
SHA1
0f6e3092d6208971444c5cd542b0d15cb44767f3
SHA256
57bf72b7073b43d5b1638f6f599f51fcf6da580e295d5d81ed02e52cd5a4f4c8
SHA512
ad8e2a3f77fda8a672b53e296d801fa79fdd3e5fb97158e80e4796de59ae7ea6bc3bd595fd87c84058f774de33e5be182c354638591e1625383ccc852afe9efc
SSDEEP
12288:2UXR5jC8PRlolRnbcBuCfXQkQPCcZaNrPJiric/aqmGp8w8Pu2yyLi:2sC8Pun+uCf79xNrsic/Dsu
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
34864aff20a32fc630075bfd425bd013_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE