DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
de4c6b899e9a7971b00891846be8c821_JaffaCakes118.dll
Resource
win7-20240708-en
Target
de4c6b899e9a7971b00891846be8c821_JaffaCakes118
Size
224KB
MD5
de4c6b899e9a7971b00891846be8c821
SHA1
9dac2eb9c35c02d65520db2b17b0b98f0b04d1ee
SHA256
56625a93fce1b3066b29402342462c7817e8006570706961f08388da30d2554b
SHA512
4f267a45a001711625bd6438f9a2e3e8fbadd83e3d9b1752d2488a6308d87012b18d690608d34f40cf941f7f17d60ff222d8164231fde09781b4e1f909d5db94
SSDEEP
3072:swx6y/vq72fvYI6Sm1CDS2cG67V7pi8L+ZFSDd98A665HFqzKGyrWxMlsXXwStXe:swx/C2G6SDG6dphYB365sryrXlsnjDJ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
de4c6b899e9a7971b00891846be8c821_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE