DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
472c3d90822bb14f950f8352d93471a4_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
472c3d90822bb14f950f8352d93471a4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
472c3d90822bb14f950f8352d93471a4_JaffaCakes118
Size
56KB
MD5
472c3d90822bb14f950f8352d93471a4
SHA1
0f4ff51103a541c2652352b388e8f336e77ef6aa
SHA256
3325539d66fb3a780757530f42f79a1ff50f9736893abc971bfd416d7999420e
SHA512
e7031fcb1084b8c9cd4e86a6140246c23ba5bace513f45157230e03eeb185b6d879b8caeb5ceadda757da5384728d80472482280599bc98ec573a42fb3fe07a3
SSDEEP
1536:wyGHusO9SjgC40Ihel1iKudWntDEtW/2xeI:wtusC24ZkHbuo9EtzeI
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
472c3d90822bb14f950f8352d93471a4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ