DllCanUnloadNow
DllGetClassObject
Nklogdc
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
435a516705262f56039f124c6517d590_JaffaCakes118.dll
Resource
win7-20240903-en
Target
435a516705262f56039f124c6517d590_JaffaCakes118
Size
70KB
MD5
435a516705262f56039f124c6517d590
SHA1
932f32aee8dad21e28f63da0f9001ec5bc838ea1
SHA256
d996fe20439e46011c41f77d35db7b82281df9e98abd56e59c5727848902a9de
SHA512
2d0a9354f8407885886cd8d2015e9aeb0e079386fbb13ea3b074227b3fecf53db55744de2daedfd4befc0f9413b73f3a5315b1611e2488728bc4a881e7dc798b
SSDEEP
1536:7XLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77GnouG:7XLwt/FiaU1Uq/dWFbNr8azD7VS372op
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
435a516705262f56039f124c6517d590_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Nklogdc
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE