DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
415e0abc2895967f548a07820b234fb5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
415e0abc2895967f548a07820b234fb5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
415e0abc2895967f548a07820b234fb5_JaffaCakes118
Size
136KB
MD5
415e0abc2895967f548a07820b234fb5
SHA1
9e203ac80aefeec773d5f15e8cba4065f360ecd1
SHA256
8976d81729a9ca5e739158ed866099f95d585a2d4e882ad8f22ccf476d694573
SHA512
1553c1d0879d0a2b70fc8f649a0df8fae708201feb9f4d23c5c678e9d63e4f42608a0f31a924f055e104a5a66bef0379da7a6dc491f6b908ed65c47d72cb4a67
SSDEEP
3072:VPQnBk1RtDlPlAKvmMWGiOtSt2aYw9LH2D/4c+:VPMBePDhlpmMWiSt2anL9
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
415e0abc2895967f548a07820b234fb5_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE