DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Behavioral task
behavioral1
Sample
44eb520cfdcddf28b0f8ecc745c3e81f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
44eb520cfdcddf28b0f8ecc745c3e81f_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
44eb520cfdcddf28b0f8ecc745c3e81f_JaffaCakes118
Size
31KB
MD5
44eb520cfdcddf28b0f8ecc745c3e81f
SHA1
0fdc9a91f1aef826442a26fbb3ffc2f664be73d0
SHA256
47d6a0e4be99178708bc475b15c528807d99689d0d3e4212e84eab889e94ed6a
SHA512
be5bf89ff21776d27f94d7ab6c78d8da25346864a9af54650f58fbaa19ef1d71e76d3c8a9ab9a7c9d732d38acc0ecf8eb31db0dc8edf298d8b04fe6e10cdd2d3
SSDEEP
768:fb9dU1Sz3Aa4UlyreJLMiMSyRciilazUEeKyr9pfd6DX0jz1cH5TFkYN3gosdPNu:fUo3lI4M2lazleKTH
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
44eb520cfdcddf28b0f8ecc745c3e81f_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ