DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
ecce11771d7c0df7dc9197f2942182a8_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ecce11771d7c0df7dc9197f2942182a8_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
ecce11771d7c0df7dc9197f2942182a8_JaffaCakes118
Size
51KB
MD5
ecce11771d7c0df7dc9197f2942182a8
SHA1
90b7811fb61d966f9e54078590d39a0de5ff5c44
SHA256
8434a25859aee4195b0e17e472d03cad813ce86964b3eb1f7833121c1c09b33d
SHA512
08abf3b18146e8bf5d2af8263866b6147dcdcc400b6dda2703179e98b489b61c5b03b54e7931f652f9e7f9ed0f3c35797737ffeea1447135f355d1a2d634460e
SSDEEP
1536:zMSFSLBm/MHKmSwMewOjoPbXza0nqvKtPYdF9ls:fFSL4kH3SiVoPbXLqkPYfPs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
ecce11771d7c0df7dc9197f2942182a8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ