DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Tranform
Behavioral task
behavioral1
Sample
e7e9b5310fd9950fbb8b3e43d1dd9e71_JaffaCakes118.dll
Resource
win7-20240221-en
Target
e7e9b5310fd9950fbb8b3e43d1dd9e71_JaffaCakes118
Size
668KB
MD5
e7e9b5310fd9950fbb8b3e43d1dd9e71
SHA1
2ab352ba4d0e9ff6575afec340eefdf5c4ca86da
SHA256
bce2759f390a4a70474c56d69ed503effff5f26897a51e63d1ca1244d5195ee2
SHA512
e56584dff789209fdb02d7330ca9d016ba5f3934b7b12b5f99fd91d40d7810a83b90d2a1cba1df5c1e160d1dec25309ba991faee92b3e2495cda56ddf49ad272
SSDEEP
12288:1ojnP65eCy7FQLHXGqEex005gIMod82J3cnUyb9xitdz3ucVhpOu7Zy/VrUmHNzH:1ojnPQBVSeRddD3I98H3HVhpOsZy/Vwo
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
e7e9b5310fd9950fbb8b3e43d1dd9e71_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Tranform
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ