DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
efe03ef322a696ae3353a0fe4d483b53_JaffaCakes118.dll
Resource
win7-20240903-en
Target
efe03ef322a696ae3353a0fe4d483b53_JaffaCakes118
Size
268KB
MD5
efe03ef322a696ae3353a0fe4d483b53
SHA1
c5dbdd5d352a14b27dcf5c2b392f8235bac916b0
SHA256
1d3fe70fecc24d81e6b8edb37e6b1c484915e8e253530aa164fecf4bfef433d1
SHA512
bdeefc31421d554ddb084bc5d3def75e95d37dd25ef88b6482dfe30d14d71649d36b54595acaad5c12849349c51e3776c0faea6ceb457f1c6c8637935d29a96e
SSDEEP
6144:ctTnMoi2Qomq2O44Vl+tING5rQm4RAbTfmFxO5uDgNLmV1U:ctTnbi2NdX44VlmlQ6TmTO5uDMG1
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
efe03ef322a696ae3353a0fe4d483b53_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE