DllCanReloadNow
DllUnregisterServerA
Behavioral task
behavioral1
Sample
47c6a2a97932a71615dc57640a226b16_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
47c6a2a97932a71615dc57640a226b16_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
47c6a2a97932a71615dc57640a226b16_JaffaCakes118
Size
33KB
MD5
47c6a2a97932a71615dc57640a226b16
SHA1
bf12f48490933eecc0dbad6ca0875f210bceee48
SHA256
e86e723591e332763c18d3c7a8504abbba9545f8c8e2c5ed4342616904cddbf0
SHA512
04d9db55686283c262d7148c93163e96a2826fb8274bad1d4ad829791416e69fad42c041ad85865c22a53d15d8184471be1ac320ef9c1c395cad88737d9a0857
SSDEEP
768:3eOyM4kfWpGnyaictck1ztT8kCx00JHQl696QKDkmgEv3JZZ:3XyilCctck1ZTcbQwjKDkhE/JZZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
47c6a2a97932a71615dc57640a226b16_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanReloadNow
DllUnregisterServerA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ