DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
24f2c5d07c90fd6191bf09ddf5acf40c_JaffaCakes118.dll
Resource
win7-20240611-en
Target
24f2c5d07c90fd6191bf09ddf5acf40c_JaffaCakes118
Size
664KB
MD5
24f2c5d07c90fd6191bf09ddf5acf40c
SHA1
3798ca8cb2db7a604c13dc487cc24c4e1e57511d
SHA256
60f0babc8bb19374e52fe31b4024d073189aee9c9db5f9842f4ce09ab24da1ee
SHA512
496ca7d45f8aab4271e64e9a697bb7096658726ef0337effe43c90b49555f6ab76ccf9efb32e67f20fec9e52b2e77dc7d1eb80545604e5cc4e37fee7f3f93606
SSDEEP
12288:sBkSl0k4VECoQ8Psqos99ZqP0jQBlISAzRw7p6fh4V+cQb/N/YuS6SN6Bfa:mkWQfodXZR0BlIR6p6f6slYB6SN6Bf
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
24f2c5d07c90fd6191bf09ddf5acf40c_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ