DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
ee8f0106303c930d11eabadaa19a714e_JaffaCakes118.dll
Resource
win7-20240903-en
Target
ee8f0106303c930d11eabadaa19a714e_JaffaCakes118
Size
269KB
MD5
ee8f0106303c930d11eabadaa19a714e
SHA1
56fe1f7a275cc08a6d96fd81c25c35c1d2598aec
SHA256
28b93a368c5060018662d1a0a3e2d701b064469d750be8647974a1939c837569
SHA512
38b98640b96f54f3a271d7005c5e28e686f1512b1c412cd2b7059a724105dcaa67fb750de2ad2b3040b1ac0e4b8c7c466dc8fbf693196d18ce5396522deaa7b0
SSDEEP
6144:sos//ny3g0alfoN326GKndjhh1LTP+K64S0kOwnLXD1gK:sos//ny3gVZH6GUdj313PH64ExzD1x
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ee8f0106303c930d11eabadaa19a714e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE