DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
123f95911c7debade248fe9cd95fea2e_JaffaCakes118.dll
Resource
win7-20240903-en
Target
123f95911c7debade248fe9cd95fea2e_JaffaCakes118
Size
227KB
MD5
123f95911c7debade248fe9cd95fea2e
SHA1
12f281616b310947d657b21a4820ab48948e338f
SHA256
c5fae2f79b83d9b0e1f4052fa8e3e2c994f59cf7b01287aa1601173a6a69e53c
SHA512
9e2ee27b907762879131873bec2b91c499babb291584d17e526573615eb72b97f1cea752caf292fade9cb014462ae7e6356c6b39832274f927bd0a79b37d7272
SSDEEP
6144:3BGsFTbisD3hJFbv3tJA56lJTNGgzKiU+fC2:3BGs5PDx7nLlJTNGgzp
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
123f95911c7debade248fe9cd95fea2e_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE