DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f623f6157ef24b719373dfabc7a1cd8c_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f623f6157ef24b719373dfabc7a1cd8c_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
f623f6157ef24b719373dfabc7a1cd8c_JaffaCakes118
Size
30KB
MD5
f623f6157ef24b719373dfabc7a1cd8c
SHA1
ef28298714cabbdd5203de62c5f9696ac6223cdc
SHA256
f24143d89e3bb44e2334eecf8ba12a42e0b98a0caab440fb97b9eaa8af33f263
SHA512
c2c0e418f4eae6c62e3463aabd1054b9c2c955fa728d510253a74b8fed781cab8333fff3beb59fec773d12c07cac8446cb1292f255a5c7a29dbe9fb78b773ce6
SSDEEP
384:CgYTQsbHlAwtJfE/0eykYClrgugH0X/pulf7wnpv12FM9BG0Xr8zH8jrmlVhrM:C7ssbFllqPq1H0vEVFMnVXr84vmbh
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f623f6157ef24b719373dfabc7a1cd8c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ