DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
30387cebf4b9071d5ebfdb3e7a35db75_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30387cebf4b9071d5ebfdb3e7a35db75_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
30387cebf4b9071d5ebfdb3e7a35db75_JaffaCakes118
Size
44KB
MD5
30387cebf4b9071d5ebfdb3e7a35db75
SHA1
e1e13f012f96c68e6318c76a2cd4b3b1364de93c
SHA256
30ca96c9cd522652bbfcc8038b33bfd3c406eb0d1bc6d2c9c8547d6328343bed
SHA512
5201d36b9ccfb7c8beb8feedac375f0ff9c8bc255da514213afe1e29b702316d50fa5a5a41e01dadf0cb1b8c1e2044b9067f324bcb6d216a9ccddeb6dfe7782f
SSDEEP
768:tLJpXoqMhtQ4TOI0MB2PLf1FkC/J8qLjCAab3I7h7UEApK:tLJp0HGMQ4C/J8uF7hIZs
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
30387cebf4b9071d5ebfdb3e7a35db75_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ