DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
5b38555ff8a434bd02235fbd9c9c8b1d_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5b38555ff8a434bd02235fbd9c9c8b1d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5b38555ff8a434bd02235fbd9c9c8b1d_JaffaCakes118
Size
254KB
MD5
5b38555ff8a434bd02235fbd9c9c8b1d
SHA1
684d691f0a99769338bb02fc86043cd6bb1c6327
SHA256
404be6b47f64db70e6e7b7bf18b941a2f1cfdf32096f61b83d8e1a1d3b8df7c7
SHA512
3e68c94a08daf2c29c30934da85883bb94269459c993f43890bd8b0b1be2388855f9873520593d8ec9032b6df2ef208ea5d84ddf814ea9ffff8facf995247cdd
SSDEEP
6144:cmXdUt/a9Q/JCyWTMXbogQc3yEizI34PCB6wb4qY6jH:fuC9QBHL3yEizIyCcwb4qY6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
5b38555ff8a434bd02235fbd9c9c8b1d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE