DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
59c4d18857f3399333d5207a79f9b4be_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
59c4d18857f3399333d5207a79f9b4be_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
59c4d18857f3399333d5207a79f9b4be_JaffaCakes118
Size
105KB
MD5
59c4d18857f3399333d5207a79f9b4be
SHA1
1ed549986739bcc9ab3cb188ebaa1c9a3dd196c5
SHA256
bf18f9201a6e9b6260ebea8e300f280a79e765c351f4e9624ce5143ec1878048
SHA512
b2084324dbc16ac3d61d8f4930050fecb5ef85de3e55757d9ace3d40aa4f28714f9eee5bc787d5de1e683ed833b72b357a5a111d80772870eadbedf264246d24
SSDEEP
3072:Nt/wP1flQO0y8E66U3jXvuw5pi4vjzDXMb:NtIP1KO0y9QXTpdfDX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
59c4d18857f3399333d5207a79f9b4be_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE