DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d633b50c163bd81f57cbb138abb203a6_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d633b50c163bd81f57cbb138abb203a6_JaffaCakes118
Size
535KB
MD5
d633b50c163bd81f57cbb138abb203a6
SHA1
8c8ba60966f989c2a410c273ec9f8a7c754160bf
SHA256
5c09211a55560ea5fca4ab80b73577574c7e377ba3b9eeb0776063dbe3f9269c
SHA512
a090f07bf21d7e6c5d021103698aadc23729b587033d3f11ecd5c5ea348496f74823fa363d042a958fc61ccefc49efba1b775e1f2c543f61794cbab13ddabe72
SSDEEP
12288:eiVWm5GzwTUSc5O/oXYWu/JUg9gfP2pecs2MmC:eML5vUScw/oXYBBoX2phD2
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d633b50c163bd81f57cbb138abb203a6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE