DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
ff48ff1c523b3d032912217be862f987_JaffaCakes118.dll
Resource
win7-20240903-en
Target
ff48ff1c523b3d032912217be862f987_JaffaCakes118
Size
232KB
MD5
ff48ff1c523b3d032912217be862f987
SHA1
8f3aae475980546e6d32d023d81b52b88ffc75f8
SHA256
85ad1e6705fc7c058c7b8aeca41fbae78039db1025d56d0ed1d990cf31ef5573
SHA512
7063d873290d95691a7b9fd747b4d84f18b268d553430ed77f967457d5d895f24a240f150d04ad51702cc3f3f522af9ed15ae972e836c0ed16f9f18b49e60bc4
SSDEEP
3072:blBdIa9pHcf9XRpbeNJZYPZAbdauKy4JOoRr61b3hXRyZLgx8pyjTs2tN5li0XLo:RB6a9pHgxveZ4AgzxJm/hy08Id7ivhF
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ff48ff1c523b3d032912217be862f987_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE