DllCanUnloadNow
DllGetClassObject
Macpklk
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
b64cace6158a32f11e1cc04b651b7b88_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b64cace6158a32f11e1cc04b651b7b88_JaffaCakes118
Size
70KB
MD5
b64cace6158a32f11e1cc04b651b7b88
SHA1
be1bbe429d58e0a6978e5fdbc27aad94bb368301
SHA256
c9f5dabd68af80ed47192721c4e03f8dba86de03cc48834840edf105365f0ff1
SHA512
3aa8bc8e82dcdfc81303c448e65f61b02ecd6224584f81196fd0a4aaa84474d89c4fc8e40df8b3ad4d3485354c759090f4a5ce15c1e98456f3c17841c407b2f0
SSDEEP
1536:zXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77GnouG:zXLwt/FiaU1Uq/dWFbNr8azD7VS372oR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b64cace6158a32f11e1cc04b651b7b88_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Macpklk
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE