DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
2b2ac65b848c243b339923812d70fb76_JaffaCakes118.dll
Resource
win7-20240705-en
Target
2b2ac65b848c243b339923812d70fb76_JaffaCakes118
Size
75KB
MD5
2b2ac65b848c243b339923812d70fb76
SHA1
78f58ba34f7c619d58a5aeb97bbc3c1c34bd7c7e
SHA256
a4eff0ea14e49720b59b0b23ad7dfeec3fd28caf439f47f3a43b20bdf6195f0c
SHA512
027047970ba986dcbd8991b221ac9f14324791bedcda6ee5a9382fd3073c80d43d828e08158bc3064c85d751491a080eb2b7c51713168b953cc6da7184aa6e21
SSDEEP
1536:BQFHJ2LiYKGCIKhJ2qNbnmR43PxgRJq1dC4qAy+ReURE3hrEHl+jlZ0yv8:SFH8XKz1hJpFnmmJgRg1dCB+QEE39AGY
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2b2ac65b848c243b339923812d70fb76_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ