DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
2616131af03f0fcf06a8844449fbba48_JaffaCakes118.dll
Resource
win7-20240220-en
Target
2616131af03f0fcf06a8844449fbba48_JaffaCakes118
Size
116KB
MD5
2616131af03f0fcf06a8844449fbba48
SHA1
7ffae79d216adacb1b6073c5a23fb8d90095f1c4
SHA256
b63fde6a602a4b94b32ff21b32da8262c0cf54e71cc29c6fcd7b9ad2edcfdc48
SHA512
c668b6374385244d830ead4036586d684dad88fcf8dc697b276948cfcb069af8f78162c0fc9d5f1101cc09b2f4f9fb120a6d894669e6ee54917098ea24507cc8
SSDEEP
3072:RfKEVUtM9aHXQhUFVJe8ZiveDWPHwKPrCl2la39KbliTyQ:RiYUtM9aHg+JNNqPwKPrCl2K4iWQ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2616131af03f0fcf06a8844449fbba48_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ