DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5d6983cca61b3062548ec74e65079ac8_JaffaCakes118.dll
Resource
win7-20240704-en
Target
5d6983cca61b3062548ec74e65079ac8_JaffaCakes118
Size
232KB
MD5
5d6983cca61b3062548ec74e65079ac8
SHA1
c784e64744b246da2c5e0ce9683d676fc6b7f17e
SHA256
ed69797b38ee8d9f6a865a0beac4aa5c33429a7066780f8cd3eec8945fd5b559
SHA512
22dd8d04ee1c89c113e1c17ed31fdd3f7255bbe48f824edebe2b2b5bb8b44f8516ff49170be65785d806aa5a9d8b8d19ba8bc4effcb09a0c7d6f993df5651af5
SSDEEP
6144:Kahv75iH71UHwTgvOKg+wgUNnmHb1p1ZRSBT8dG:R75ib1UQg2SwgZRZe8dG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5d6983cca61b3062548ec74e65079ac8_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE