DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
1011afb139588f907db2e44b68ba3259_JaffaCakes118.dll
Resource
win7-20240221-en
Target
1011afb139588f907db2e44b68ba3259_JaffaCakes118
Size
66KB
MD5
1011afb139588f907db2e44b68ba3259
SHA1
185260254fb829097a3176e3f2d0a8dbe2155ec8
SHA256
c4a78797698ce5bbdb30da9ca430999508cd963f7b753c7b7bded6299a94bf06
SHA512
293a430256c01d40621c17de71dd0d9b22f7b388c662ccdad74ce64704179b07c3a331a6db676ecbdb9484ebfff3d43dbeb194c30c72d05c1c3cf02be6efd3ce
SSDEEP
1536:L2h6z1D1qUE2VZKbXsmuVVkz57CakdkaFXCEky9yzqBura3vY:q6V1qSmuVVkzganaFXCE0trKvY
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1011afb139588f907db2e44b68ba3259_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ