DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
1c02c7263cd3037d7e7200dab2c96efc_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
1c02c7263cd3037d7e7200dab2c96efc_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
1c02c7263cd3037d7e7200dab2c96efc_JaffaCakes118
Size
43KB
MD5
1c02c7263cd3037d7e7200dab2c96efc
SHA1
fa23219ea807b4b17383474df9f4dfc919075ed7
SHA256
9d207ca051af3a2caf51fae643bedf275ad58d58452d17d49e5eafc0b4f3cbe5
SHA512
d025a1c3d4a0ce04e9f7f0de09022d31e22aee1205b665c92b03ed2a231c06c401a29aa9863c801133137e2bca4044d44a3b12f0ae43f94348635338af6d3beb
SSDEEP
768:NLb6BRrFXVIaQp1rkcbkxncU3zStt+T6aWEt7NJth6cm5NXsbnNGM:5b29Q3rxkXDnT6GScm5MnNf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
1c02c7263cd3037d7e7200dab2c96efc_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ