DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
01bc1dc2dcc1a4436026d5dd2215c2ac_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
01bc1dc2dcc1a4436026d5dd2215c2ac_JaffaCakes118.dll
Resource
win10v2004-20240802-en
Target
01bc1dc2dcc1a4436026d5dd2215c2ac_JaffaCakes118
Size
200KB
MD5
01bc1dc2dcc1a4436026d5dd2215c2ac
SHA1
d124d7d3e7c9fb4a99d473bd62f9d6bf479a389c
SHA256
b898bbf2ef90d5f090c29c4ac5986f2cb426f20be59d12e2ac8ff1c91aa551a7
SHA512
4de08eb57d0c87fd4b6d9ee924aea8bc0a50fb52b9dd63f5cbf387203361f582ba548cab300ef4706e09ca4f16d30c4c65a614f96aeb7f75ec825f4cea7e9bca
SSDEEP
3072:lookSvuxm8jnhteS/fCKsNj/NRsVtSnd79GnMlFeu62qFDTN:FaxVnhX/fC1oSd79GnMTvQD
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
01bc1dc2dcc1a4436026d5dd2215c2ac_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE