DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
1bbde0164608764794340a99b90c1bdc_JaffaCakes118.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
1bbde0164608764794340a99b90c1bdc_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1bbde0164608764794340a99b90c1bdc_JaffaCakes118
Size
17KB
MD5
1bbde0164608764794340a99b90c1bdc
SHA1
b8359ee9e98bccb3b5b10319ead6505e8cf94539
SHA256
aff4ab12df7abcf3b511ed242604ed4796f85ee9aa6fa688f51487d88a0acb1c
SHA512
bfa3c831c33cb4affb1daaebebf6ca613e4978b3f39a45cf425bc60f747121b86e2dd6b597c9186e560fc2b992aad26c1fe563e046ad354bdffa9c7e21f758b1
SSDEEP
384:NaR9y0e+Fpg5vNGc1BWGLWvubD/vLnP4DyfYIanX2gEDW/W9:+Fpg5vNGC4G6KD/vLnPbfYtGgy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1bbde0164608764794340a99b90c1bdc_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ