DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
396e3cbcc9b5dc321c16becbc60e572d_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
396e3cbcc9b5dc321c16becbc60e572d_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
396e3cbcc9b5dc321c16becbc60e572d_JaffaCakes118
Size
75KB
MD5
396e3cbcc9b5dc321c16becbc60e572d
SHA1
194fc0ce07a8e8620a87899b4e21cb676f237985
SHA256
bcd1c11188c05f41782e2cc333651363e3475c538e522b5c24b81c7125310dc7
SHA512
c76e4eded7ac97d672372aafd0b2ac7b9940e98d0aa12f8581128e42ee89bbce3b8e4b07e1d803f2ec2a013a1949936a585b6a7fdd95ffab78da066456baa023
SSDEEP
1536:Mpwkx+j6tIhorPrNztZl3xFjJmC57Xn7OIoXnQTZiROQy1TsTc:Mphg2tIhorPrxbl3xXLXNoa0g6c
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
396e3cbcc9b5dc321c16becbc60e572d_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ