DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
c8d5097c638ba6f54e54c2d4a87d0d27_JaffaCakes118.dll
Resource
win7-20240729-en
Target
c8d5097c638ba6f54e54c2d4a87d0d27_JaffaCakes118
Size
95KB
MD5
c8d5097c638ba6f54e54c2d4a87d0d27
SHA1
b43af62367584f5539528f21219c76c554530c05
SHA256
a5f34d063c86a6368a68798b3e5285b0677f7fbdf983be2e94752c959a3824fd
SHA512
b9528d42f4a2b0fc7dd6960bfaf9706c18d790d237677335925b74300eed3c5fcba35c22b8177f15254ea51fec3fffa0cc7b8e88135664ea6a24cda7d53bd0b6
SSDEEP
1536:3/qsM2wHHyHE0/nPTIO0n0MtBwV3AbSQ20bs6FqYuU8OJiO97FGKfaEuwOpI5hsf:311/nPTIO0n0MtBwFMSQhI6UfuiO97QD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
c8d5097c638ba6f54e54c2d4a87d0d27_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE