DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
4cdb9f59e0622074f10c12bfb1cf290d_JaffaCakes118.dll
Resource
win7-20240704-en
Target
4cdb9f59e0622074f10c12bfb1cf290d_JaffaCakes118
Size
182KB
MD5
4cdb9f59e0622074f10c12bfb1cf290d
SHA1
42f33e98da2d26679bc69f0c06bc7f362636ab13
SHA256
1b61ec5b73fbe13732d63c77ed2c4ce50316e253bb60306c6d40daf092364d49
SHA512
4a72024315bcd0a98eac5ffc1d3f86d8743b6e7827819caa6b0fc3e6ffe6735bd484cf9942e98c651659b2adcf30fece38028b6501514ef6c8a38dddfc96e921
SSDEEP
3072:zscUXYm5bkVHe2rHVGNfb81tfzlwAfC5efgVNg4Yub1vpaEWrzDDVLA2ysIIpkby:zscCYm5weqeTKRzCAfC1Lg4YupcEWrzh
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4cdb9f59e0622074f10c12bfb1cf290d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE