DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
3f608d2ff99da158b785aa1772c52c12_JaffaCakes118.dll
Resource
win7-20240903-en
Target
3f608d2ff99da158b785aa1772c52c12_JaffaCakes118
Size
86KB
MD5
3f608d2ff99da158b785aa1772c52c12
SHA1
bd713996fb5bc52c12d70036b2ab9323f95de1be
SHA256
e6a130f8ba2a150bbb98f9305f9fbde1d300c03f758cb1d5e0ce1ed8690ba6a6
SHA512
ba6786caf7b6ef7fe2c8af6d94214103413940faa1c97219c7ecd211ac98856169276035237e93047e6609a9597b70ed61e2af357f970c26a17e0718d5f485c4
SSDEEP
1536:2D5wzSDmQq7wbSSokNrU/4VZZYElD++XOmTeNINap/8lWVZnJwfko/gM7DIVJ90:k8wbSf4je0emThAp/8oVZOfb/gMnI6
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3f608d2ff99da158b785aa1772c52c12_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE