?CreateInstance@@YAPAUIDownloader@@XZ
?DestroyInstance@@YAXPAUIDownloader@@@Z
?GetVersionInfo@@YA_NPAUtVERSIONINFO@@@Z
?IsSupportUrl@@YA_NPAD@Z
?ReloadConfig@@YA_NXZ
Behavioral task
behavioral1
Sample
3f00781128336e3fed7e77114ede1530_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3f00781128336e3fed7e77114ede1530_JaffaCakes118.dll
Resource
win10v2004-20240704-en
Target
3f00781128336e3fed7e77114ede1530_JaffaCakes118
Size
193KB
MD5
3f00781128336e3fed7e77114ede1530
SHA1
df8f29949d5a300ed916d2c7fff06b15eadc6c40
SHA256
d80886444f43a9641317edc449a79b6e23af81cac9645106412bad6ec393a7c8
SHA512
11c558dd7ad13e9b5efe7654e2762d9287ace6c707f4dd28fff72e1badb98307a10a1e791559224074632386928d45cd0eef26a81abb2587c4cf82e0d4643d0d
SSDEEP
3072:f5hhn74rjyjXg5BUhhsp71VUUuvjybhosjPF2SOVjpJEnowjmJNmdED:xhhEryg5BWGha/vjyH4jBwKJgdED
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3f00781128336e3fed7e77114ede1530_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
?CreateInstance@@YAPAUIDownloader@@XZ
?DestroyInstance@@YAXPAUIDownloader@@@Z
?GetVersionInfo@@YA_NPAUtVERSIONINFO@@@Z
?IsSupportUrl@@YA_NPAD@Z
?ReloadConfig@@YA_NXZ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ