DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
b6777279eefa10b432d0bfd9d3017abd_JaffaCakes118.dll
Resource
win7-20240704-en
Target
b6777279eefa10b432d0bfd9d3017abd_JaffaCakes118
Size
431KB
MD5
b6777279eefa10b432d0bfd9d3017abd
SHA1
46432fb16821082b05ad93b5af3947ef3eaf545a
SHA256
e59a2061891aab334637af8aeb36ca9846b188ce3a08c00247e43e24a796e524
SHA512
86c82589da11f041993d4febe984e9683ac0dc7c396c91beed807b2a52bade852ff1ccf2b5600336579d15daed9a6d805be34b14bfa0fe1adcdb81c5733ddea3
SSDEEP
6144:rXoE4Rd7Tp+QDe6Z2mfrp0+zs2j/xnwhIT8Pk6JUA2RhS4+yGYVQNQgiTInAi5i:EDP/8QC6Z2A0mOhI2SRhSnYs/iWAS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b6777279eefa10b432d0bfd9d3017abd_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE