DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
cfd9ae7e684bd0f262150e8e75102bb1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
cfd9ae7e684bd0f262150e8e75102bb1_JaffaCakes118
Size
228KB
MD5
cfd9ae7e684bd0f262150e8e75102bb1
SHA1
79744b9186018aac918b78f677df3f7e2df253b5
SHA256
9d6608add3f97ed401c65bb485d0bde69900284773336f441e04184abbf21937
SHA512
c69130f99d652e6105b99935f08dd21c09c6befd27332785dfd5d3514ed343103fb491a0debf7971bafd489960719db5835ccf1980aa027c65119ef63239b712
SSDEEP
6144:rO6qr56/njukd3bfcM9uBcmAUESfGj856cCF3V12:rOBr56buk3bUMVUrp56jVV1
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
cfd9ae7e684bd0f262150e8e75102bb1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE