DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
e27f90f4664e3943906d9571b395d327_JaffaCakes118.dll
Resource
win7-20240903-en
Target
e27f90f4664e3943906d9571b395d327_JaffaCakes118
Size
224KB
MD5
e27f90f4664e3943906d9571b395d327
SHA1
6d5e77dd92ef3d8f7b41374dc1e6dd62af7527bb
SHA256
5a7e19b92fec888a51cb3c286f2809c508f21484020670c66d429d5860c9540b
SHA512
e3c4e3b6deb116049b2d0b243f264d3cb2f6e225cc32da82f103da518239077ce91074db9b68206a1a6e78ab9c110914dc656759fd361b58d08ff2dc6d0f5cc1
SSDEEP
3072:iwx6y/vq72fvYI6Sm1CDS2cG67V7pi8L+ZFSDd98A665HFqzKGyrWxMlsXXwSWR6:iwx/C2G6SDG6dphYB365sryrXlsnuBM
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e27f90f4664e3943906d9571b395d327_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE