DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
b6cb7382a7966244f6a99a2fa42a1e24_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b6cb7382a7966244f6a99a2fa42a1e24_JaffaCakes118
Size
130KB
MD5
b6cb7382a7966244f6a99a2fa42a1e24
SHA1
f9bff56f4e0a763781c7f59b0ec0886a7ca88b21
SHA256
be15f9ed5edd004558cfcc41a0bbc9940b29c6d9e187ef58fce244e1e2e5cc86
SHA512
0471f70227b30c1a67ebdfe12005343e666c7f9c27a83e6c18ae04402e39880cb9d3345d3dca99f5c54be1660d63ccd2712d83a63d98b471d3bb16b928159663
SSDEEP
3072:kprB/Koy4S7PXg1ajXyd7LJ+RUgQU1pLSFfhO9DpO1ooutdn:cr9fnSLYCkyUgQkuFf1moSd
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b6cb7382a7966244f6a99a2fa42a1e24_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE