DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
2fdbad655de27623f29765fe4b50e9c2_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2fdbad655de27623f29765fe4b50e9c2_JaffaCakes118.dll
Resource
win10v2004-20240708-en
Target
2fdbad655de27623f29765fe4b50e9c2_JaffaCakes118
Size
48KB
MD5
2fdbad655de27623f29765fe4b50e9c2
SHA1
1050c7136a857f6f16ff270e5d6bd6a591400d57
SHA256
90e26954c47be3cd5838658403994f90ac086e27a2b500b7934d12eb83df3dfb
SHA512
427ac53f184f6beef644b8db4276191a7073ad0fac7b0d7ac490b8834ba0ced317d3ed33190954b13d921bfccdd8f3a28213edabdb92252c7a5cb31e6ebb7e56
SSDEEP
768:iE8rCD6HZUpTyQiTqHcCFENBV9gme6/kxIHWUYgzSJCUlHbikPbw4ms3h:dpY4+QOqSgme68xI2UYgzaCUlHbnbmY
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2fdbad655de27623f29765fe4b50e9c2_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ