DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
d6ad38c208c7fec526b23722ae40ced6_JaffaCakes118.dll
Resource
win7-20240708-en
Target
d6ad38c208c7fec526b23722ae40ced6_JaffaCakes118
Size
119KB
MD5
d6ad38c208c7fec526b23722ae40ced6
SHA1
c183b53549bb7c7b74689f51ced2ff184a09a9db
SHA256
0d1158d6cd76e579370675405060b1a836703ef273719e6b6559df7f01f03bfa
SHA512
1abfd3d3c089012efd9ea6c53ca71db4316819622f5d48f4527b25b1b0ca1b66551d0397c019cbcd5cd62260589cc96dc1a232becd9c32e97f077befc98e1fc6
SSDEEP
1536:8MBr6r7A1lQRiw6s1XRoSP9715i3++LuSSzzsaNbMldXa5K2hVl:NGr7AB6XeWcRSzJMnAR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
d6ad38c208c7fec526b23722ae40ced6_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE