DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InstantAccess
OpenAccess
ecnhe
eswhe
euhwe
iedisco
Behavioral task
behavioral1
Sample
3bad56bdc827b48621f062ec16508f92_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3bad56bdc827b48621f062ec16508f92_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3bad56bdc827b48621f062ec16508f92_JaffaCakes118
Size
65KB
MD5
3bad56bdc827b48621f062ec16508f92
SHA1
71fbed7dc13c992f9dee761fad58a3d63eec5159
SHA256
24e7f82f1160f8f277ea8ac63aebeb2e135e907319373f3613fd0cce10652ede
SHA512
fcce6d8bee1f099fbd64b84bbee45ddfd2beefdfb2373fce1162c0ee4b0e1e3d8ca7b8c92e7bcd1f2592c6531a5c91fc0fe4cbd8a91931fc07621825eb3914a2
SSDEEP
1536:21hu8tlRjwDe9UOkKSYHxLIbAlbw1luoXQFo/O8L0iA:ussRmWUOkKSYV9bw1lsoNA
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3bad56bdc827b48621f062ec16508f92_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InstantAccess
OpenAccess
ecnhe
eswhe
euhwe
iedisco
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE