DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
8cce0f8d3a9c3de72c21b49ce5702b57_JaffaCakes118.dll
Resource
win7-20240708-en
Target
8cce0f8d3a9c3de72c21b49ce5702b57_JaffaCakes118
Size
51KB
MD5
8cce0f8d3a9c3de72c21b49ce5702b57
SHA1
b4673543614abf8bf3380487a3df29d67b0e73c0
SHA256
6e6c9cb88196547f2ab372256c22d058100f280011efc6bcf4b88d5f6eb3dbbf
SHA512
768138a1bbe8969e4ba4b961b2a40c8cdf0f773929750579d73bf4dffd1ea5709d5dbe008229d2d0030d92971411b11a2d79420112fe401e00ac0541905bad77
SSDEEP
1536:9OsCHNvhHxyHTlXtcYlS/KQwmQBbh/Yjmsvpnouy8RaWSzDj:OHPH6lrSSV/Lu5v5outIjr
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
8cce0f8d3a9c3de72c21b49ce5702b57_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE