DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
302a83e0dcc2e5189037049983ac645a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
302a83e0dcc2e5189037049983ac645a_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
302a83e0dcc2e5189037049983ac645a_JaffaCakes118
Size
42KB
MD5
302a83e0dcc2e5189037049983ac645a
SHA1
d1a67a8b47384bc98a2de6f3306f8ebcd7d6c9f0
SHA256
2609832eddf81508faa7c2c6a7690eaea9f8e7e514205f89cc2ad4dcd48f4a57
SHA512
27c6c2dcc2fc4dfc9f2834b73fc5009c74c17e990632407dc335a3b9a8838c7eae6b9d9626ef6dd36ff7f670b00b63be1552c9d0704d9a2fe59cd3f8611bc26e
SSDEEP
768:Sp/UkHOB5DnmQUuzyO1gIMf/7eb+qYLSGIFwO2/KaPP:/kuB5DEayOEeb+q+SGIF4hH
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
302a83e0dcc2e5189037049983ac645a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ