DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
866575dbf7ac1178d32c83dd067018a9_JaffaCakes118.dll
Resource
win7-20240729-en
Target
866575dbf7ac1178d32c83dd067018a9_JaffaCakes118
Size
224KB
MD5
866575dbf7ac1178d32c83dd067018a9
SHA1
823400adc0623b54eb7e21b7b2f733a24b0295df
SHA256
c98f1aac5c1e72d05167292b429e383ab2388980c2684135564983cb1571c6f8
SHA512
41194ff49d9e293661d298454c6292999b2cd8752071261424f537c9360b06b988db8cc25234421c2fe5d1994dc9083ea9e89c1c5f1e57dc6910f112345b6d2c
SSDEEP
3072:5wx6y/vq72fvYI6Sm1CDS2cG67V7pi8L+ZFSDd98A665HFqzKGyrWxMlsXXwKopG:5wx/C2G6SDG6dphYB365sryrXlsnt6s
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
866575dbf7ac1178d32c83dd067018a9_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE