DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
_CallBack@12
_Init@16
Behavioral task
behavioral1
Sample
ea67c499c35b5afb9c5731078c006949_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ea67c499c35b5afb9c5731078c006949_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
ea67c499c35b5afb9c5731078c006949_JaffaCakes118
Size
191KB
MD5
ea67c499c35b5afb9c5731078c006949
SHA1
9801505ebdf1daa56b86d092f6304a377752212b
SHA256
71ed669900d86b4045a85c9f4bbaa07f434ca5193f18a35618541d7bec1727bd
SHA512
fe1f871725dc6cc139a2e1be1982799ad12839f1344120fb6e220266567537d1a9d3eaca4b01df39c546e516f64cde5ba919159100e1effb38788f92b8e0eeb5
SSDEEP
3072:J1Lklqw3QDSuU3HetkUulvA2R473nObl74heMTK/GV/BrZTveJ2IIF37y:J1yD3vSP73ORUhzO/GB1w2Zm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ea67c499c35b5afb9c5731078c006949_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
_CallBack@12
_Init@16
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ