DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
8a5bf925a43373137d4c721d168f9940_JaffaCakes118.dll
Resource
win7-20240708-en
Target
8a5bf925a43373137d4c721d168f9940_JaffaCakes118
Size
78KB
MD5
8a5bf925a43373137d4c721d168f9940
SHA1
0a5cfb70b85ae481443b3e31aef7551c3308cf87
SHA256
31de0f37cb3232156abe05aaa657c649483f4648ab28cb03100333bae3a4014e
SHA512
79fff329fa8535b01725491a7937517cdffdac2423bc6c9341798c823e1666aa336de8e8e0b278cbe13193a4427db94a12796ae8a8cdfcdd42757e0929faa7a3
SSDEEP
1536:AYCooIMd/fb+tQvk2g/SdTgmo50YeH/hCZlnWpE8rvDZoIT6Fnouy89R1rL:rCw7tQ/OS0/NWpFR+dout9R1X
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8a5bf925a43373137d4c721d168f9940_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE