DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5b3376c6101d6f6212a830b996f5ffa3_JaffaCakes118.dll
Resource
win7-20240708-en
Target
5b3376c6101d6f6212a830b996f5ffa3_JaffaCakes118
Size
249KB
MD5
5b3376c6101d6f6212a830b996f5ffa3
SHA1
e9e5341d96d931c208c155898b3cda0208bc85da
SHA256
f27235a86d6d12db9148034cb74731472e9a31b55f2600031aaa91946e382680
SHA512
884149c269114c99c396e8582b7967035abd3be014d08632c6033f69b2eee4a9b3013f09c3d4f39afa6339920802adf71fbadad43d2cc9cfe98eeefa1efbc0ee
SSDEEP
6144:HqFJ2wUwqb5XdewYMviYcW8/26+1HyG60l0xSt71dW+3Ou:KuHwqb5NKM6YJ1fixSZmc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5b3376c6101d6f6212a830b996f5ffa3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE