DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
3d44424de39f963d2cd1a5cf9b0e3227_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
3d44424de39f963d2cd1a5cf9b0e3227_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
3d44424de39f963d2cd1a5cf9b0e3227_JaffaCakes118
Size
53KB
MD5
3d44424de39f963d2cd1a5cf9b0e3227
SHA1
56d566b95fdb43530d6ebc39e311dc5bbf2e63aa
SHA256
1aa831c0e5ecf320e910339cbd559cf06469773a163f6f7dc3f8d6994948cf88
SHA512
838998aacea831cd7c299a94ce2fc185c799c7dc0ea826203baa0855e3a06ffb4f2cfcc9ab6276d2f8ac72705fbcd01db3a530f502d6b0a141cbe1a760f2e521
SSDEEP
1536:uCO9u2ZECW5prIjeH3THiRtH1udAUzhmU1ZG:gw2ZECW5FhH3TirILdnG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
3d44424de39f963d2cd1a5cf9b0e3227_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ