DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d31d67040cdb1832d3a05be747b5da76_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d31d67040cdb1832d3a05be747b5da76_JaffaCakes118
Size
233KB
MD5
d31d67040cdb1832d3a05be747b5da76
SHA1
ac45c2aa47a087fda2359ceb6337373397929b85
SHA256
2286cb42d6a9b76e10341b40620d748b20abf02148ad7f1826ef0eadae3118f5
SHA512
0d6d1f892b7d69331334b458b0aa76300b66a5aaebc35ced49761d3ae6b68b1b4c02337c8f849fed7a8f43187c6a60b396cbfd3b408f2752e62a2975f879f4f3
SSDEEP
3072:GLIS1FgLwi52pEOBEAuI8iBSRwVomNnDGIEdMpvuquhFdPamSR/MgrEri2b3FX:ab1FgLJ52p3scBLyYKpdi8hFMP/pA3R
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d31d67040cdb1832d3a05be747b5da76_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE