DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
fed2e358a938df994a81c354025fad6f_JaffaCakes118.dll
Resource
win7-20240903-en
Target
fed2e358a938df994a81c354025fad6f_JaffaCakes118
Size
232KB
MD5
fed2e358a938df994a81c354025fad6f
SHA1
7d4b2b39b2a7fa6b925d2ecdca7d3a5fffbc677d
SHA256
0403cf3e36bf2beeba62d47142cbff329ccf3f4878ba4f75fe9b902453122ac0
SHA512
470d5aaae9b4f9de2a8b56edcf09bd07a8331289897be40d6942cd4b82afd2a1f1a9349d4583ca1373fadddaa5be4abf196f280b0e10517273f2fea78e97d9fa
SSDEEP
6144:aa7NkzWuqz8IwwQF1wG2RVMKjRjShbDiItnIaXdFy7k3g:XNkzpqYIkF192zMeGhPiI1IajyI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fed2e358a938df994a81c354025fad6f_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE