DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
667e02955e6fca43d17bd9acbd529b66_JaffaCakes118.dll
Resource
win7-20240704-en
Target
667e02955e6fca43d17bd9acbd529b66_JaffaCakes118
Size
269KB
MD5
667e02955e6fca43d17bd9acbd529b66
SHA1
0699de386e9d53628448bd544556584a0f09f590
SHA256
4d617590c48d9b4957432fc05aaaeff5980aed49a60d1204b5a7b80534b648f6
SHA512
8f47a79628f13533ea29477ab7cb02246702335656331fda82fd27d6e5393ed7d9e2663208d5073392700acae7c49fbaf12d58a48fa0afc7b101ff79efb44a20
SSDEEP
6144:sos//ny3g0alfoN326GKndjhh1LTP+K64S0kOwiT4z5S5:sos//ny3gVZH6GUdj313PH64Evzk5
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
667e02955e6fca43d17bd9acbd529b66_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE