DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
f961b30ce7731b9c71c17e73c13288d7_JaffaCakes118.dll
Resource
win7-20240221-en
Target
f961b30ce7731b9c71c17e73c13288d7_JaffaCakes118
Size
18KB
MD5
f961b30ce7731b9c71c17e73c13288d7
SHA1
bac454e6b4da5ac7b796c8142a5c219a8dba0c09
SHA256
dd6fde8546cb0aeda340dcde37cee41827fbde8e002f1cd5c7b4b6beda2984a2
SHA512
d1468b22a9e7f0f14ab110889a260eded3cd18f0d77aab3e1ebb781823f0299c6e7b1409822fba1af977c9d5b2a2979450dbaef20cf9f4a9d4257f6b288eefb9
SSDEEP
384:cEHricOJLaOvH6RMv8R2KU8umHYhJvvK5PsjoydSZS:cEHricOJfcB1LkB6s
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
f961b30ce7731b9c71c17e73c13288d7_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ