DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f273a04752e61bb2b742295a9cf4c1dd_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f273a04752e61bb2b742295a9cf4c1dd_JaffaCakes118.dll
Resource
win10v2004-20240226-en
Target
f273a04752e61bb2b742295a9cf4c1dd_JaffaCakes118
Size
28KB
MD5
f273a04752e61bb2b742295a9cf4c1dd
SHA1
3903a9e9b4c19b231d0526f826af7a443472d6b2
SHA256
9e647be890d6ef702b1648d66d6c7b2dabcbbdd45f82ad1b1906fa55ba563325
SHA512
80ff96f6940f4200f4cde8f9bc59336be986300570aeed3ce8e3e65d078e849daa21bda4b51b81f3072c5957de18f52679576ea906866baac15b212ed76e3943
SSDEEP
768:nTPg4lp9usR1nCB6OUhn5JBZk/8DPmBfPeLSr3:T44lTusRwN4fZk/9f2Lk
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f273a04752e61bb2b742295a9cf4c1dd_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ