DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f419e8188e858ddfb75fbd15288b280c_JaffaCakes118.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
f419e8188e858ddfb75fbd15288b280c_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f419e8188e858ddfb75fbd15288b280c_JaffaCakes118
Size
47KB
MD5
f419e8188e858ddfb75fbd15288b280c
SHA1
1d55f189c590953b42a20e35ae85488e4d954c2d
SHA256
8d8afb6f6816f2941495a5fb451b68e412e5fd9a11649e77a2af1b251f7a61e9
SHA512
181f6f081580b6acd78c5fd88a447ab37db3790edf5bb8bb1014fecca4043faa520dfe98b3712fc1d042fb3bb98a277e1cf2fd2253431d57e41558b65ca35457
SSDEEP
768:0/jFAJWsjGFu0dYA4NB0LiDlhkcamiKedXa8SUhKX0HbEOoX9rTJjSwS4D:05ij8u+ByxDNdiKedXOGKwbM5S94D
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f419e8188e858ddfb75fbd15288b280c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ