DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
24d1cf4617913fed6fcfaf5640449b64_JaffaCakes118.dll
Resource
win7-20231129-en
Target
24d1cf4617913fed6fcfaf5640449b64_JaffaCakes118
Size
103KB
MD5
24d1cf4617913fed6fcfaf5640449b64
SHA1
c823b46bd8c1afca8fa58c3648813370b596ff23
SHA256
e4ee21f57e611292d5e0f29ac9447067634d8e53291ca20a0cb10bad4f96fd56
SHA512
f76ae110341d9b2e491cd6ddc248cb6577a2ada7d74b144b9c5dc98c30a7227c6723b471b486298441fb14f55f5a1f172fddafa1f87c6d43dc3bc9d0dab7a9d9
SSDEEP
3072:Bem9/LMWcVbJ2BOKDIMlQPxOWZrR/71/0eRsN:BemlLMWcVbJMlDIMmPbZ5V0xN
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
24d1cf4617913fed6fcfaf5640449b64_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ