DllCanUnloadNow
DllGetClassObject
Olcpoml
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
c082273582a8c4a118302519b57fb71c_JaffaCakes118.dll
Resource
win7-20240708-en
Target
c082273582a8c4a118302519b57fb71c_JaffaCakes118
Size
70KB
MD5
c082273582a8c4a118302519b57fb71c
SHA1
82a6251b881847185c568d57d666928086c6310d
SHA256
81c0050c6d3ab6f22d738e544d8acdeef8350db9a6b155d368795b12a1fa4cb6
SHA512
e847b0219ebee39c1a9e21e6607862f1ba3bf90060d2ae717d83dbcfe51faf2dc1ff0653e8382ecd4eef1c82198f19d1c48600ec2c6ca978bdcd4e6f4ca13f33
SSDEEP
1536:BXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnout:BXLwt/FiaU1Uq/dWFbNr8azD7VS372oS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c082273582a8c4a118302519b57fb71c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Olcpoml
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE