DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
b56d676bbbfaf403ebfabd8f9cf2987c_JaffaCakes118.dll
Resource
win7-20240705-en
Target
b56d676bbbfaf403ebfabd8f9cf2987c_JaffaCakes118
Size
114KB
MD5
b56d676bbbfaf403ebfabd8f9cf2987c
SHA1
de82b8c30c430b9a897ad5f875f7770b40033792
SHA256
62730fcb7f518c554cd9d229f99881e51babd6017158ea17152070678adafeca
SHA512
f8380770d0a17fff5b751f4e6c315e0abeaf46b32184cf0b07b5aca20655f566e9aab0781d528f2243b985a10642a23259aa16e167802d10800b99fd1b2a4a93
SSDEEP
3072:OgujePVp428vz2UOlBfLuo+hqp+iZ0gtpotx:ue9OjvOlBYhDMXo
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b56d676bbbfaf403ebfabd8f9cf2987c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE