DllCanUnloadNow
DllGetClassObject
Pmcjobg
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
ceb1a9fc807857c4a4f881b00a56976a_JaffaCakes118.dll
Resource
win7-20240708-en
Target
ceb1a9fc807857c4a4f881b00a56976a_JaffaCakes118
Size
70KB
MD5
ceb1a9fc807857c4a4f881b00a56976a
SHA1
aa514b35c867ce92718950733694fdb5dcafc56d
SHA256
d5a6ce028428780ac2a256ad0d90f7c038ee535fc6e3493411f5455495648c9b
SHA512
4eea05d044819ff4fa8773186b2dc8194a441e2f4316eaf430f1b9199ba200800c49949bc69bfc7a6936bbd347e9b173b30b19f92a8491c18033cc6182907b97
SSDEEP
1536:6XLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77GnouC:6XLwt/FiaU1Uq/dWFbNr8azD7VS372od
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ceb1a9fc807857c4a4f881b00a56976a_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Pmcjobg
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE