DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MyCallCBTProc
Static task
static1
Behavioral task
behavioral1
Sample
30a49b393b07aca58d1d1354169b3b1c_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
30a49b393b07aca58d1d1354169b3b1c_JaffaCakes118.dll
Resource
win10v2004-20241007-en
Target
30a49b393b07aca58d1d1354169b3b1c_JaffaCakes118
Size
11KB
MD5
30a49b393b07aca58d1d1354169b3b1c
SHA1
492754aa049f782c0898a8311e568fcf591ff4dc
SHA256
dfa1a3efeddddade4344216896ec421d5536973edbb543d8d1d080d441a00964
SHA512
ae8e6b2146d0dd4c49060d85f2652e9a4141a2df0f8758521b0ab0ba705a8e2cd94156c7c8845d3784fa4937724e656f74c87e86dfa1d5a0a38b486ec0073135
SSDEEP
192:QAm7Fm1T2e25rwH2vlnzOJQnP8yZGfSEl2fcUYSryJoIwsx1Al:bS4pTsrwWNn28tZGfSCUuJoBsA
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
Checks for missing Authenticode signature.
resource |
---|
30a49b393b07aca58d1d1354169b3b1c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
MyCallCBTProc
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE