DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
4df3d0b4edbcebc7e49a09c0755d8008_JaffaCakes118.dll
Resource
win7-20240705-en
Target
4df3d0b4edbcebc7e49a09c0755d8008_JaffaCakes118
Size
239KB
MD5
4df3d0b4edbcebc7e49a09c0755d8008
SHA1
af5d6e69a9a6f66d0013c2a0ae32d0a78f3d3b4d
SHA256
dc232d32dbe8913f702110eacea5caa02f4ec614ad2e925b4dabfc591ba5a6f5
SHA512
d78f9d861687fd9a91763e45f825d76c267ccb397d469cd6b8765848ef5dfc39ac7c1610435806048398ddcfc7386e44d090f82fbba86e9086348c4c5ac8bc1a
SSDEEP
6144:1jboSD1u3fbRwoc6WuqTrPuV3hFigKos0sXFQm6Hsh:14Shu3zyoWhTrPuVRxEl1zL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4df3d0b4edbcebc7e49a09c0755d8008_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE