DllCanUnloadNow
DllGetClassObject
Lkmelap
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
6294778fc3d2012c00781d0fa65fe57a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6294778fc3d2012c00781d0fa65fe57a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6294778fc3d2012c00781d0fa65fe57a_JaffaCakes118
Size
70KB
MD5
6294778fc3d2012c00781d0fa65fe57a
SHA1
4e712bd341fdf0804c2a370936927a531803223e
SHA256
b9318cdd7b512f8fd0d8a9469d397e6ebca44809ec9a78396dd23b078f7cfd93
SHA512
cf833fd86e8765268499491bc607773a0382cc61f202fe8761cb67a7556a7b55e4c765798630bffe80618d923245c98fc9ee754bac9f52791f602bf9af18f16f
SSDEEP
1536:LXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnoux:LXLwt/FiaU1Uq/dWFbNr8azD7VS372om
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6294778fc3d2012c00781d0fa65fe57a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Lkmelap
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE