DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
effc40d0c46498fc76141702b6295bd8_JaffaCakes118.dll
Resource
win7-20240221-en
Target
effc40d0c46498fc76141702b6295bd8_JaffaCakes118
Size
52KB
MD5
effc40d0c46498fc76141702b6295bd8
SHA1
ffc177091c985f2108fe7c329a21f3fdef44f286
SHA256
78747dec649aea13d608204057584ca921d865c5a2ae8815167b6cc37e54785a
SHA512
62dbb9ac1426e76994d8789a88672ca828a99a5f8eee9f1c4a2377f10cba08e2c5831f7b814d5e0265049b58c968cf20563817ed394b5a7a4445c37810c8a705
SSDEEP
768:IXeQOsG1fDDvL8PoPgYThftCIlwrDpigyN1ebBozUYmFCHQjLWsoCi:ADEfPDcsgtpiRN1eNumFyQ/WsoCi
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
effc40d0c46498fc76141702b6295bd8_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ