DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
ef151aa137bf76dc6b58fadf8c10a41b_JaffaCakes118.dll
Resource
win7-20240903-en
Target
ef151aa137bf76dc6b58fadf8c10a41b_JaffaCakes118
Size
233KB
MD5
ef151aa137bf76dc6b58fadf8c10a41b
SHA1
26f18d0f7ab20ab1f42a8eb4ff77ff805f4760af
SHA256
909b1470e9611bc0f2a405b0f6ae020550ff94d1d64c993aec3e8ffcc53e9fff
SHA512
3a88c26859ed52f2fdea01c841a6c4c1dd54138a6b61ec194409d60c38b20a61a335879e9e0f6e7953994a6c2bf5da78ed1d3676709c58e021a95b7508411096
SSDEEP
3072:Fl3MLKyBG3M4MTAiIunvfQ/twcPVwmFFUmSdN91vSv7IJniKzHz62mFTxp+0ZByU:r8OyBG3x+g+cimSddv8I62c+0ZBWP1n
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ef151aa137bf76dc6b58fadf8c10a41b_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE