DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
129a3085485d2cf73fa47ce403ffda09_JaffaCakes118.dll
Resource
win7-20240903-en
Target
129a3085485d2cf73fa47ce403ffda09_JaffaCakes118
Size
228KB
MD5
129a3085485d2cf73fa47ce403ffda09
SHA1
dec0c20ad240701e7469ae22299d4d8cd184ecec
SHA256
7e3ae54d8edee2dfbbaed025c7718e4b6a60cbfe9b3031e50b56e57b0019ee16
SHA512
07172e1869be00c1d81d3985d113d99a8dfd39b1008d9ffbf36c29e353e5c2dc02f8e2b7c40a7ffbd3117ecb63cfb64a09eee1ebbf648c0997387ebf9379f966
SSDEEP
6144:zBG0qLgLy99votEg1GGhsbol+4ymMsNzrRvaSq:zBG0qsLynOEggGhPlNymvVBq
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
129a3085485d2cf73fa47ce403ffda09_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE