DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
959d394d378ef6d4896aec9dc1a99b89_JaffaCakes118.dll
Resource
win7-20240729-en
Target
959d394d378ef6d4896aec9dc1a99b89_JaffaCakes118
Size
10KB
MD5
959d394d378ef6d4896aec9dc1a99b89
SHA1
09e205f2d7e822f017caf58d29f3c8a5b40f7e4b
SHA256
58b6ad064f67d224c513d19ba53e3845ac87de7a5297ef48932fd7960be302ef
SHA512
4f0c399d6f9020f07b547544cd005a821decc18aa6ea39229c266df9f409432b5165d0f8210ac0ec8e8169146b47f63e6d414ce7183139719f57ec0bbeec7faf
SSDEEP
192:fPA5X6wbOoNRd6vzOuhPdP14DuLUqusDeu7YM2rq5DsoFaNJhLkwcud2DH9VwGfX:nAB6lgP6vz/hf4DrADeGYM2sDscaNJaw
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
959d394d378ef6d4896aec9dc1a99b89_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE