DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
bd170b7a33d8d7c4f0420e7b2e999f3a_JaffaCakes118.dll
Resource
win7-20240704-en
Target
bd170b7a33d8d7c4f0420e7b2e999f3a_JaffaCakes118
Size
13KB
MD5
bd170b7a33d8d7c4f0420e7b2e999f3a
SHA1
7c05315c8ac48436ac208640959cccaa84328d49
SHA256
15d9809e9e47f6392fd5ffc548fb866a579509df2219993d5a55e5a014161d83
SHA512
47c500273d5ba8a6f31164bf545ea46fd20234f33788f62183dc9fa829c2f30858e5f4d6662b57f243310c2a0692b19aefe498043c7040c1794df055adb46cc3
SSDEEP
384:GPee6QMlX6Y7hp7KwuOLxMQpEDkmegqog:GWeesK77KwTLxMece0g
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
bd170b7a33d8d7c4f0420e7b2e999f3a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE