DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
fcbe0000a801b5645b5d219a6d391f6e_JaffaCakes118.dll
Resource
win7-20240729-en
Target
fcbe0000a801b5645b5d219a6d391f6e_JaffaCakes118
Size
234KB
MD5
fcbe0000a801b5645b5d219a6d391f6e
SHA1
8199cafe2b7dc3d74942a330ef584bf53425decc
SHA256
923e5ab085e2544faad6c97b8ff012fab36a2f27584ba1f93ddf1c766c22ef01
SHA512
f412a55541cdc9ede98f2eede03cdfaa14c2bd822d4996e926c57b865816b5fcf3ec357c55aa615ab8f0d5ec9f54d181a07382625126ee42c06f7e30931b0a94
SSDEEP
6144:aqeGMgdM5/gX7aj3ffIZQ0gqWiU6lAqu3rpyPlAPSS+:sGMW8/goIa0LWi7lAqu3rpWGSS+
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fcbe0000a801b5645b5d219a6d391f6e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE