DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
b864e0427528c9e435ed199dd8b6d155_JaffaCakes118.dll
Resource
win7-20240708-en
Target
b864e0427528c9e435ed199dd8b6d155_JaffaCakes118
Size
391KB
MD5
b864e0427528c9e435ed199dd8b6d155
SHA1
80e7e32768a9b03bddcc6ff71a7979b78cf118ea
SHA256
f69718f2b17e69b40e825396a98a83a773bf159890874dca9ce758e66aa16b35
SHA512
a85c354bcabc03eb5dc1e5f31f3b6908a358fb92e5530fa6fb557dbf15d707aba8cff430d60e131b8920f20437781cbb8a6a363a76c0fd9784ba1ee904a3288c
SSDEEP
12288:AP7PqGxigZxtxwBwcVrFZRBPEuyHaZ53:UqXgj3G9RBPk6ZZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
b864e0427528c9e435ed199dd8b6d155_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE