DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f49b55a0e8a030bcc6fd58a9245baacc_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f49b55a0e8a030bcc6fd58a9245baacc_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f49b55a0e8a030bcc6fd58a9245baacc_JaffaCakes118
Size
45KB
MD5
f49b55a0e8a030bcc6fd58a9245baacc
SHA1
db65912eaf9f106b26687d20d188e28c4c520256
SHA256
10683dfcd35ecd01dff49cf41bd916b6f437d3e705ded2f751d652419582cf6f
SHA512
2fba38c8f168e0038f40a78cf796156ba27d18234a99df62d6f75b76e4c78952622a18eff904f79a9ea19dc09233301f84554c794540f229740cbdc227c3c98f
SSDEEP
768:NL8jxCw8xQE4glPlnnvHTDhVY1gyCb9gdok68fUdgRzIdrSXhTzBEoYsBq/fg:5oCltlPdnvpygBbquk68fjRzIFYzSonX
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f49b55a0e8a030bcc6fd58a9245baacc_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ