DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
34e4ff82bd89e5acf623e737873343f6_JaffaCakes118.dll
Resource
win7-20240704-en
Target
34e4ff82bd89e5acf623e737873343f6_JaffaCakes118
Size
233KB
MD5
34e4ff82bd89e5acf623e737873343f6
SHA1
b922371b63c89ae44ad66b4d92ae61f5ac8e60ec
SHA256
968d076e47ac371098381008d149187ad5556d91f523f057bfa0779b85be6034
SHA512
a6627906ff4b043464a2cdf0ea887b871767acc2115ae000b922a98d7766c1419ed6396f2117ce9eff597ac5653e610d2e01ffbe9893d28dda1f5bfff5958c87
SSDEEP
6144:BqWGMxiZ6FvRAuvAdt7JABguGZkdD5G13u4a4xg4WP:ZGMS6FZk7JAhg1e4a4tm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
34e4ff82bd89e5acf623e737873343f6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE