DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
3aff6c05349d9117b5b6f70740d21f4d_JaffaCakes118.dll
Resource
win7-20240708-en
Target
3aff6c05349d9117b5b6f70740d21f4d_JaffaCakes118
Size
19KB
MD5
3aff6c05349d9117b5b6f70740d21f4d
SHA1
3cf9c72622ebc54ed82038af89768ca54624ee9e
SHA256
1182ae410aed1498d7dc5cf19091a90598cdf5877e4410ca5fd08fd734f0252f
SHA512
7152ea9a54909f43abdb1b4fb87d8b35afde17b946df72761c41c0b8e93d435a36e69e13f42dc1720d1cff8c052755822bc1401878f02d238070227057abe954
SSDEEP
384:g0sbKtXTCgRFj54iGdvX0er/PYsYEfhBEhutC8Oa1b:fsOtDzjm9vZr/swhS
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3aff6c05349d9117b5b6f70740d21f4d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ