DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
0583d9cda4575062fb982d4201c80a52_JaffaCakes118.dll
Resource
win7-20240221-en
Target
0583d9cda4575062fb982d4201c80a52_JaffaCakes118
Size
8KB
MD5
0583d9cda4575062fb982d4201c80a52
SHA1
e8d21672556034ce77fdd1d5548c3924dc687c23
SHA256
d3240b495941838df6c7fde8401c6757414bca1bc1176cb77d1ff9b82a2652a2
SHA512
e6599175f7945f4eb19f4c2018e1eeae08df59e433b998d62512e00761083e461aa489fab4e4a2c13b96c0c45c2609d4c64b9d86183cc25afaf26a37436b3d42
SSDEEP
96:0tidzwvOspDxE3nANjhgaOJDjon5MHMstwh0WhGG/Jiyll41nwcgEob/2jXxq8Eb:0EdzgpDu3CjhgaDn5jstyh/JqDgt2gx
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
0583d9cda4575062fb982d4201c80a52_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ