DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
df17ce437a8da009e40aee04216376b7_JaffaCakes118.dll
Resource
win7-20240903-en
Target
df17ce437a8da009e40aee04216376b7_JaffaCakes118
Size
105KB
MD5
df17ce437a8da009e40aee04216376b7
SHA1
c9b7d4b5942b513b0f0f0fe9e8cb8fe787d91d4f
SHA256
bc7ccd31d808693c1bcdaf05ce4492dd4f2ce3e4bce9426cd89b174179d89b73
SHA512
7738b3fefe5313fc3040b5bd2e4580aa3ea717a4440e29fd7d2d77ba8d0345fff11ee5355e66b2e83722e699436ec8e632055a8566b73671d582547bef9c932c
SSDEEP
3072:gEvoMNFeKwrEw2xtaDQf1k5WhK0m26Cv6NZZOPV:g+owxw2/aTWVuCv6NZwV
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
df17ce437a8da009e40aee04216376b7_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE