DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
71f78ec8befd56b11a422392640a26ac_JaffaCakes118.dll
Resource
win7-20240704-en
Target
71f78ec8befd56b11a422392640a26ac_JaffaCakes118
Size
8KB
MD5
71f78ec8befd56b11a422392640a26ac
SHA1
c06a6a6f6900e12d42763b8d71e55b01ebf387da
SHA256
b652bdaf10b08efae41e1571cae1e50bccb0c866def9c19bc70cc61ca9bcd997
SHA512
9ee89f959bf560ec88515da012dbe8ff71797b9a924dc11b2c8fac6e65ae2ed3f2b79a8c43d07e6255e7fe8082533ff38a08ae8f281a946e080bf147eac202f5
SSDEEP
192:3q81zx4uNQPtJIBUiXBAp+5OnsUC1KwU2KOUEn0OAwFD:3l1FfNk8Bvx0EEC3U2KjEn0O
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
71f78ec8befd56b11a422392640a26ac_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE