DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
22475c14e62f15a2e47f89b77ce544c4_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
22475c14e62f15a2e47f89b77ce544c4_JaffaCakes118.dll
Resource
win10v2004-20240508-en
Target
22475c14e62f15a2e47f89b77ce544c4_JaffaCakes118
Size
48KB
MD5
22475c14e62f15a2e47f89b77ce544c4
SHA1
366702a26ab977fe306d6fd60dc6533de4ce6550
SHA256
86522db061383a27db5a3674f4440d58922f8c62884d87c71055c074dabc3dbe
SHA512
d01bff3bd2bf144e9d49f2d50314e3f62ab6a21817ba96b67cf86e82a8a0407cd093ff7bffd12df90961864e2abccfcb8505c6058adbc2d811f51eb573911678
SSDEEP
768:RDqLqk5GYBj0JCjm+M8rDyg6JN0z7VmC3T16xL2s74uRFWPlm:5qTVmmm+BnYeX8NxtHYm
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
22475c14e62f15a2e47f89b77ce544c4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ