DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
fd1fb8c4411580806910930daf9541e1_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fd1fb8c4411580806910930daf9541e1_JaffaCakes118
Size
234KB
MD5
fd1fb8c4411580806910930daf9541e1
SHA1
600513d8b34cc29f7088c3dd2237076db827076c
SHA256
90c9a718003bb0bbc74212aa82a0590ed8b7293cf09ee87b27501bf8b1a9aa5f
SHA512
2a5811f1f05ac2e3e0d5567af26337a99f6ede0afe2cd71d608ef30d2f80fb7caec2c5d5cc808500a39e4bfd87216a7e50ea653917e0a9bee5a65a9da064fd34
SSDEEP
6144:K3NhMt1fi7z5DwmUi55bjOePHpUPwBu81TRu6QDZlkHw:K3kt1fiZDwcbjOeK2tTRu6YkHw
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fd1fb8c4411580806910930daf9541e1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE