DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
fb4f044f5e86796b6874d1eb4b926a3f_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb4f044f5e86796b6874d1eb4b926a3f_JaffaCakes118.dll
Resource
win10v2004-20240412-en
Target
fb4f044f5e86796b6874d1eb4b926a3f_JaffaCakes118
Size
1.2MB
MD5
fb4f044f5e86796b6874d1eb4b926a3f
SHA1
00343a5652cabc85dba6c990c76d94fa065d5d80
SHA256
da06579b597a54939db2a355b883f149b114a54027ad200c81ccbf2fa072a04d
SHA512
aaef8b2d91e3ebf99f7a5b666d4697d1bd3fab2fb1cc15adfb51580a23baa47b03b64b8629ac5290127bde5bc6b911f27040721659c56e39febe667fa3501086
SSDEEP
24576:7BX3gX565cxPGZ6qCuIKz/KynoxaoMQkiHw8oSt+FmFh4aLibqR:VXCqqI6qCu9z/KyoxrnHw8b8Ah4aLfR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb4f044f5e86796b6874d1eb4b926a3f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ