DllCanUnloadNow
DllGetClassObject
DllInit
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
9503198397b731074c57a2a28a246cb9_JaffaCakes118.dll
Resource
win7-20240704-en
Target
9503198397b731074c57a2a28a246cb9_JaffaCakes118
Size
1.5MB
MD5
9503198397b731074c57a2a28a246cb9
SHA1
f6ceefdc57eeffc5b7be64f7265c677afd9d975e
SHA256
dbc0a8b7871e4994acce663b2b7bba96683389fb80c2de4366e9fc394e5fe69d
SHA512
4e61772077a473bc0430a241c0730522521ca8de7d53bf54f2af383780731ee6d7369eb1055548dea21cb9c4b40c9d579939238765d9932f84d88904846980a4
SSDEEP
24576:A6SjEivGe6W1l4dkEH0NBjqIftsL6vihQxF3K1pRRcNaWpY9AWoyXFmqk3mb7JvS:w7ZgIftu+GQ3K1pRRcN3pY9JV03z9OJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
9503198397b731074c57a2a28a246cb9_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllInit
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE