DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5af6aa692e1a703c6d462c5ab9484ffc_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5af6aa692e1a703c6d462c5ab9484ffc_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5af6aa692e1a703c6d462c5ab9484ffc_JaffaCakes118
Size
139KB
MD5
5af6aa692e1a703c6d462c5ab9484ffc
SHA1
bf9c9ea74af3fa0561369bf6cdff88e02636fcae
SHA256
6aa14d2f0232e0cc57258f217587a33d035379361f3297cc87e8bb047c0ecd97
SHA512
f8386a85ca989d4079a4ade56ee426465fb0a337273c201695055dc60eac2a1a34996f69ba0a06cfe593183d1ae12a0a76878b8cb1ff9f3cbef53a8b717171ee
SSDEEP
3072:APQSeRuOqEMAw4/nbf6h1HvA9BUZvHUwaBdpkU2pKMfiO3n6QaorOBZ:APQSeRuZKw4/L6h1sU9ed67KwLao6L
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5af6aa692e1a703c6d462c5ab9484ffc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE