DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
f607d27d2d2eeb615458b416c073763e_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
f607d27d2d2eeb615458b416c073763e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
f607d27d2d2eeb615458b416c073763e_JaffaCakes118
Size
160KB
MD5
f607d27d2d2eeb615458b416c073763e
SHA1
7fa2fea8cdec775062599a51eb850bd701e017f1
SHA256
622ccca75c9cd04d243c94c376d05f5ad79c0f9bbec78b9e0677f0f608d16e92
SHA512
678272cdf6f9a4fe5bec4cc77e4e5b6926bb406e5799d9e073f2dba0a317cce95cd0f3f09ecab4d9bfccc72cfe005b0fcf8bc5170f2c6d40cc2845fabd42d602
SSDEEP
3072:Uc2DCWrIOQ38NFm2Dbr02KlmId2s3Ne//HuuAZPZr:DSCKIOQ52DbI2KlT2ucnu1d9
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
f607d27d2d2eeb615458b416c073763e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
MessageBoxA
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE