AutoSpam
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Remover
Setup
Update
Behavioral task
behavioral1
Sample
fb10a89a44d8e52d5c46911544de7c8c_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fb10a89a44d8e52d5c46911544de7c8c_JaffaCakes118
Size
880KB
MD5
fb10a89a44d8e52d5c46911544de7c8c
SHA1
f184cad0fc882d61e9cf0ea1551457c6fd252bb1
SHA256
7dcd44de2940521fcf1bad15c9c9ef60677db6aa4808a93f309f5b5bae68e0b1
SHA512
3e50717134ed27c8908087132f0261837c2ed75ba9a189e0feb1462b7ebbd2c074ff24fc798ed86ceb97bbc39bb5abb019a466b00591275863eebaa6476e2639
SSDEEP
24576:JH2E4FwNqv+HpnlpdulCsivkl2JpHTHw2M5pqk2jij:IA00lDulC97JpHTZM5QkcS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb10a89a44d8e52d5c46911544de7c8c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
AutoSpam
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Remover
Setup
Update
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE