DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118
Size
43KB
MD5
f6b745f4fc6bf809a52c7e2c43798f62
SHA1
c878c19f9229c86161a2dc1c218205793e1315bf
SHA256
28f6c2bc3bf55eb9a683bb81258c3996043964a915c043e0fbd6318f9e5d07cd
SHA512
cea63f51c21855c8a0ae34df488c1131e8af0775622943e7c1847dd0467727f046518d8aee5f58faa744258c49735229828f0db8e17e729a1ed81d8d9f008b05
SSDEEP
768:NLq4/GmuTkzrda6+K0f+kXjb6hXsW4gPwe1JtM+8mzD+E0XrA4rmdU:5qUzHda3K8BXjbY3PwetULXrA4rm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f6b745f4fc6bf809a52c7e2c43798f62_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ