DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Fn
Behavioral task
behavioral1
Sample
1c90711177f3d6d17f8e9e7fd7b5e13d_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c90711177f3d6d17f8e9e7fd7b5e13d_JaffaCakes118.dll
Resource
win10v2004-20240611-en
Target
1c90711177f3d6d17f8e9e7fd7b5e13d_JaffaCakes118
Size
17KB
MD5
1c90711177f3d6d17f8e9e7fd7b5e13d
SHA1
ba067d7d165555e220f996305e5b650246c3dccd
SHA256
c45bf06973e23b5aeadf6d2b3e720acbabb92410cb8f0b51ac6d6877ccf1a28e
SHA512
29f33fd0b57d39ba3ab2ef6ca65d1a5db41558f0ca919a2c0a48c4c98de74daec896299e3082d0c0f4311e9c2327ca3f1ef7583ea2543198d3d2cd63b7779c28
SSDEEP
384:JQtbsE5WssuR5Emo7xzGstnKNLDq10LzTf5NZBjADPN8wTl:J0sc+mclnCPq1q35MPN8wp
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1c90711177f3d6d17f8e9e7fd7b5e13d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Fn
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ