DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
a5775ed748a6e1cfe7e63065e64e458d_JaffaCakes118.dll
Resource
win7-20240729-en
Target
a5775ed748a6e1cfe7e63065e64e458d_JaffaCakes118
Size
15KB
MD5
a5775ed748a6e1cfe7e63065e64e458d
SHA1
25e62c3bd7dd85d6ea5d315985f52e7e4323aa17
SHA256
975cd833942298d182e99ad129401aca06b9efea236a9b87cf5983671b955150
SHA512
ebf77b779615bb9666c12c9e988e066a95aefca89b666faf686ad40f23eccf0d5d999386a2798c771d395683d9a04276c0c24c26a0ddfa8372b577135f610f40
SSDEEP
384:+jaM4CtcZJSfBYMQaNJawcudoD7UgWu2ZLWDuKYJLXb:kJ4C6Z635nbcuyD7UXMuDLL
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a5775ed748a6e1cfe7e63065e64e458d_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE