DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
fb296a1bcc25dcd87c7b5af89e6966cb_JaffaCakes118.dll
Resource
win7-20240221-en
Target
fb296a1bcc25dcd87c7b5af89e6966cb_JaffaCakes118
Size
148KB
MD5
fb296a1bcc25dcd87c7b5af89e6966cb
SHA1
aea865075c609fbdddc29eb2f351805c4bb2ccad
SHA256
09b20e0460c8db8928b769db2cfb556000d51e1dbf01b7d74bb7b23e1e7787e3
SHA512
ae2b601500cfb430c560249ae1522e33a2d03733a9ccb3302ae0accb25c0d63d53a6eb022f0e6f1500724786689166cdb3c87683e7b8ef4b621efc7c3ca195f6
SSDEEP
3072:z+bs0gLUw0i+HcLzYr85Tt2u3AwwNcDFObLxKKvYCxaZ:z+b3gp0okr1u3Aw7w3xKoYCxaZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
fb296a1bcc25dcd87c7b5af89e6966cb_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ