DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
e2695d814a34633f14f4fc39d0262298_JaffaCakes118.dll
Resource
win7-20240903-en
Target
e2695d814a34633f14f4fc39d0262298_JaffaCakes118
Size
10KB
MD5
e2695d814a34633f14f4fc39d0262298
SHA1
c98429e44969912c5104bcc203efe89b7d0dcd05
SHA256
e3661798b1f3425f8948b2f03334ac5a121b408e1103ca58d252b39c916649dd
SHA512
728db69916b16b6e14263a24fcea14b196d4583c0a31cf7cf970ff5fe3dbbda8aa4c75d96038af416b567e384db55c1d390ccedc3f3c881630d0d0613da2b14c
SSDEEP
192:ALheJCWrhCJ9W3Fm0rhipIfSyV3NNfr+WyUAFaNJhLkwcud2DH9VwGfctq/G:Ag3AWZ/6gDiWz0aNJawcudoD7Uc
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e2695d814a34633f14f4fc39d0262298_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE