DllCanUnloadNow
DllGetClassObject
Pnolkkp
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
67260f1c13ae53930c194143ad0190c0_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
67260f1c13ae53930c194143ad0190c0_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
67260f1c13ae53930c194143ad0190c0_JaffaCakes118
Size
70KB
MD5
67260f1c13ae53930c194143ad0190c0
SHA1
d91b9d374371e567f35cb15ce424032592c01abf
SHA256
38ce1777a8c134750de35bafbb74a36685b68a68ffaaa30c610a569ea4095087
SHA512
b2f404387a6aed92ab42fa3b3e97fb0822bb15deb1ef0b3a6d1dec5df9a6d0cc641d46cfb7696b303d9eea499637285444a3dc46929d6ae612e14c5ed0badd8c
SSDEEP
1536:FXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnoub:FXLwt/FiaU1Uq/dWFbNr8azD7VS372ow
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
67260f1c13ae53930c194143ad0190c0_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Pnolkkp
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE