DllCanUnloadNow
DllGetClassObject
Pmmcpmp
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
d100501fe2caf40f0745bd33a98f757f_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d100501fe2caf40f0745bd33a98f757f_JaffaCakes118
Size
70KB
MD5
d100501fe2caf40f0745bd33a98f757f
SHA1
f7d5d4f2659ee97b808c93f90e535256b6197f27
SHA256
4f6776c5c5f8d192cc5d9c028f4c3879070a6517300eaafbb8d0ccd5692c6812
SHA512
5294382acfa2cca4f397eb1d15de1292f69d4309ccf537b1db5d0e5f546d335d3e2bf3abfd795f5500ba67c5c4965d8313dd81430e2c9b5172f3ca2a37cb561c
SSDEEP
1536:0XLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnoun:0XLwt/FiaU1Uq/dWFbNr8azD7VS372oo
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d100501fe2caf40f0745bd33a98f757f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Pmmcpmp
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE