DllCanUnloadNow
DllGetClassObject
Pnoeomh
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
4093330256c61ca02bd57262d5755b3c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4093330256c61ca02bd57262d5755b3c_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
4093330256c61ca02bd57262d5755b3c_JaffaCakes118
Size
70KB
MD5
4093330256c61ca02bd57262d5755b3c
SHA1
2bc4125fc3611ce7828276e9905948e7673f0ec4
SHA256
064059b6b8af221afa7fc6e6758c1c2a1cde5856b5190d5bc480008ed45f9234
SHA512
5d9c62476b8ef3ab2ec1fab57587688ede17e92bc81750a354c55ea3a47a8e7f154c8bfaaa3ec334d552d78463ea9f12673aecbe65532193f52c461491c18040
SSDEEP
1536:gXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77GnouI:gXLwt/FiaU1Uq/dWFbNr8azD7VS372ov
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4093330256c61ca02bd57262d5755b3c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Pnoeomh
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE