DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
a9a266f5e680e640c20cfdbe0684362a_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
a9a266f5e680e640c20cfdbe0684362a_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
a9a266f5e680e640c20cfdbe0684362a_JaffaCakes118
Size
3.5MB
MD5
a9a266f5e680e640c20cfdbe0684362a
SHA1
c812b8a43ee95abe01f8d6fff9f11e50d9d4a5aa
SHA256
38aac23a23dcbdb50b2409d32ef0f18d2df852a70093412e6b83816f3c3de1f0
SHA512
f581efdbfb96a90d28ecda0a43ed6df4ad7f57f85434715cc30e9117108bbbb287ac4bfd38e5b20deacde87201d79a80d6fe4af6fab0f478e7e6c804b5ab03da
SSDEEP
98304:8dO8uWMJDnI8/pfDyLOM7zYHoSBbLCUODzx6yvHIkQBxFFjALkRgp:8mDnPxfAQHvmxF68HI1B+9
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
a9a266f5e680e640c20cfdbe0684362a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE