DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
315495d63c99ac321b672ec11ba90349_JaffaCakes118.dll
Resource
win7-20240704-en
Target
315495d63c99ac321b672ec11ba90349_JaffaCakes118
Size
13KB
MD5
315495d63c99ac321b672ec11ba90349
SHA1
4a20e044396811ee099261f2b8bb98a6e63f8f23
SHA256
d0c9d821a555f5f06afc6ae8d06d4cd4352f11856fc134f02599f09a827d189d
SHA512
d2d8f226f1a49c6d63c3a9b72f3c26c2b0b789783386edc92aa16e6c2ece2b942ec45a993856e9f2033015079d739c7a2e4bee21db42a4b139187c6686c53e81
SSDEEP
192:1AFaZpZpOPkWFuFZwc0f5LTd7PtPDCXmk7g+rW8A:1AFaZ3pOPhFuFqf5LTd1CWX+
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
315495d63c99ac321b672ec11ba90349_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ