DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
5e57dfcd2ade8df203d93b36fe39147e_JaffaCakes118.dll
Resource
win7-20240708-en
Target
5e57dfcd2ade8df203d93b36fe39147e_JaffaCakes118
Size
8KB
MD5
5e57dfcd2ade8df203d93b36fe39147e
SHA1
02d72d8d9ac44df00536fb86ef26f227629086f4
SHA256
c529eb083c5fe424ea25a9b690042cf8557c93c08e0d8a40ac3ff7a2003b59bf
SHA512
ca5eb20afd16f53858ca836a0a483b58bc5e19746e4f3ccf63dcfb0a2b88a4a257e0025b5d5ba1ec78f03e21d128c19b71c3a6dc071e162ec8e3e8ccd8297c2a
SSDEEP
192:DlYKa5TcKBLH3qpwq95BocEtJloujEgfSs:DlYx5TvBH3o1nulot
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5e57dfcd2ade8df203d93b36fe39147e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE