DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Tranform
Behavioral task
behavioral1
Sample
393de966204488c04bc65e8dd861672c_JaffaCakes118.dll
Resource
win7-20240704-en
Target
393de966204488c04bc65e8dd861672c_JaffaCakes118
Size
1.6MB
MD5
393de966204488c04bc65e8dd861672c
SHA1
317db5ed5b734f5415edcc51c6af51850b54487c
SHA256
0df8065e33489fef9794ec4f9abd5372b47e289fae7d69bbfeeac1dece52f0d5
SHA512
f22ebbae294c1d1e79e9e50ad1cd167e248a5b3f0edc03f95b53aa874686486172c47149b11bd92c4bc8c39bf980132f6b612d78c8edce72e14cd1a736849d71
SSDEEP
24576:kntIAHtPaJN/S7GHw8WdTAxckDdzM2vOM+rssifkfIX3ZD8u1sxB2LpTD4A:iIDP4TAx/DdzFGLW8InV8isxB2L
resource | yara_rule |
---|---|
sample | themida |
Checks for missing Authenticode signature.
resource |
---|
393de966204488c04bc65e8dd861672c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Tranform
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE