DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
95b96bae468432b8c52e349ef95b64bf_JaffaCakes118.dll
Resource
win7-20240704-en
Target
95b96bae468432b8c52e349ef95b64bf_JaffaCakes118
Size
234KB
MD5
95b96bae468432b8c52e349ef95b64bf
SHA1
6b79f8cca3c966d094c5aa16d8dd0a2f44dd92aa
SHA256
96458fdb337a09f72c4757e53018353c8e576229240ed4aec6dd9d64ad245962
SHA512
09af36b4e3b5aec7664d46c54d0b56166d934424ff46d4f1362b249f98cd32c25f3f7556921e7e4c6014ac1f63d8ce78e50c3540974f0e66e9c21a6fa32a9dee
SSDEEP
6144:S3NhMt1fi7z5DwmUi55bjOePHpUPwBu81TRu6kmUAVNL5:S3kt1fiZDwcbjOeK2tTRu6+Ad
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
95b96bae468432b8c52e349ef95b64bf_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE