DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
2b10f12c49de4cfcadb8c9ab78e43f54_JaffaCakes118.dll
Resource
win7-20240220-en
Target
2b10f12c49de4cfcadb8c9ab78e43f54_JaffaCakes118
Size
126KB
MD5
2b10f12c49de4cfcadb8c9ab78e43f54
SHA1
589df384d9739d23d4ce7a1cf3f2da57f034793d
SHA256
66d26fe8327749855c3db11eb9609609207860d2ab8cc24e09f2c27530e848ee
SHA512
9a19f49e28f09f65fc52e0e740f8644c64bc05626900ab3ca9ce3be6ce1c64fd3f02bc34974aab1fa1d278220d968528e917298fb3b61c262119764614cc9133
SSDEEP
3072:RS5WU1bUMSEd61GND6AZOHQ9Xx3zirk7iwGPy6g+mSRn:RALb1682ACQ9Rzir31y6fmy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2b10f12c49de4cfcadb8c9ab78e43f54_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ