DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f0a7cde621747d4e1864c1cc39c4a803_JaffaCakes118.dll
Resource
win7-20240903-en
Target
f0a7cde621747d4e1864c1cc39c4a803_JaffaCakes118
Size
229KB
MD5
f0a7cde621747d4e1864c1cc39c4a803
SHA1
5cc5a9cb1dd15baa580aa26fc9838ac685d7dafe
SHA256
9fb392dc99bc312354a3592ea203718209162e51f6d6b9d97c0b0d66616fc438
SHA512
d16ce7e9076fca7fee391e4f0afbdd4b120bd595e6e7d89251900a7ce785b49adf414a5e1e4d64f26f18bd0dff50f13d6d272e46e3f377ccbe968a7d522f7295
SSDEEP
6144:Vvblqdga5Tc+mkoIvRMV94kTtNCalLpMPpCW:VzoXtoWyzCeL4p1
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f0a7cde621747d4e1864c1cc39c4a803_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE