DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d66df77933bbcd2c3d03092e9f1b3009_JaffaCakes118.dll
Resource
win7-20240903-en
Target
d66df77933bbcd2c3d03092e9f1b3009_JaffaCakes118
Size
232KB
MD5
d66df77933bbcd2c3d03092e9f1b3009
SHA1
2c49072f1b3f4821e3772af5958a4bc17d368fbf
SHA256
64d9a0f6ef4be7a32c49c54a8917c0f66b50910457e0cef783b7c175a59cd07c
SHA512
8daf3023546aaec956148630a4f20c4f09c79bebae009c465aa04be043742b73b0bfad326e3689cbdeea9c17dfd29d50625000d821339bc0d08981286e0bb05c
SSDEEP
6144:Dahv75iH71UHwTgvOKg+wgUNnmHb1p1ZRSSZ47U:K75ib1UQg2SwgZRZWU
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d66df77933bbcd2c3d03092e9f1b3009_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE