DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f05d036f48e35cbd514473d948ebbdb1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
f05d036f48e35cbd514473d948ebbdb1_JaffaCakes118
Size
209KB
MD5
f05d036f48e35cbd514473d948ebbdb1
SHA1
885c88bd4b50b36bdb4fbe73249880814335a4fe
SHA256
21b98caff32768eebea8b0598397cf38f2b6117f11b6c853a26abe72db34abff
SHA512
095c20553daf51651a67d323f4d05dfaf2a0b645f884dc1bacf782825031e15b944d327198cca5aacc78ffac12537243010a2cf239a467fd47a37389b422f742
SSDEEP
6144:NxJbDzzwGOwpgzbthHWG82E55r+xShaMRfps5Q:NrDvwDhHWG8RPBNS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f05d036f48e35cbd514473d948ebbdb1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE