DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
cefafa91081450b31af737d49b20ca13_JaffaCakes118.dll
Resource
win7-20240903-en
Target
cefafa91081450b31af737d49b20ca13_JaffaCakes118
Size
269KB
MD5
cefafa91081450b31af737d49b20ca13
SHA1
ad891d8addcf984d680fd426dbbc6631fb1a2251
SHA256
310ff84369d1df94179d65f7e80638976918f30cc881ed7a057e981299a57c22
SHA512
14b3544b35b897724d60bc2bd8cab43cac962dfd1f81e77950350064225ba4e2455906cc9d352447858e447caa967faeced2cb0cbae91c6b41f778524bfbd4dc
SSDEEP
6144:Wos/gHPDgjc4E2zlTEkCSJy4zUB8FTs7r8nvZcJj:Wos/0bgAalRlJy7Osv6GJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
cefafa91081450b31af737d49b20ca13_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE