DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
dfc6e7d30e403a8e4b7fd19125741edc_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dfc6e7d30e403a8e4b7fd19125741edc_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
dfc6e7d30e403a8e4b7fd19125741edc_JaffaCakes118
Size
52KB
MD5
dfc6e7d30e403a8e4b7fd19125741edc
SHA1
ae93f30e26afd300b4b70230ba3cd3dc7a1dd259
SHA256
0a0b47880f6c490953a5ccee7db3a7f6bda2d1f920c53e4ed40183a18e9d056d
SHA512
97121298a189bf97d62cc78c7e1b4cae0da7be910314bab6831a00c2235e5674969f9f831b3d1ccd01807f3be56485a0508ed32016cd731a41d874f35ae6fbf9
SSDEEP
768:bQnw0l4xDZIXQIWaDSvQdv0LSNEB/m0uG5A1yRSxtXbtkFIYwwkxwnbcuyD7U:bQnw0k5K4vWNW/m0u9YEtkF/w0nouy8
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
dfc6e7d30e403a8e4b7fd19125741edc_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE