DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
684813778aa01e08cd02feb5de5ba3b3_JaffaCakes118.dll
Resource
win7-20240704-en
Target
684813778aa01e08cd02feb5de5ba3b3_JaffaCakes118
Size
67KB
MD5
684813778aa01e08cd02feb5de5ba3b3
SHA1
b9bb5fccdc9430bc4225fe4046de1fffd4703ccc
SHA256
47fd50fc9c5b6d6e30ad2dd243418183c64926a0b8d7843f962bf92d40f01948
SHA512
7e8e784be61c595c09560bac17d4ac275a5cc97330a033342e9bb3d07541217bbb0a84753456924aeb97904fe4e6d13e032e28a5ca34c444bffd4d166f3b7f09
SSDEEP
1536:z9mHyI5qs90FLM3S4YQu9iQ1gs6OFox6wE1I5vh4nouy8LIi:z+yAX0dMELsQgs6srKfwoutLX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
684813778aa01e08cd02feb5de5ba3b3_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE