DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118
Size
42KB
MD5
4d9a85750ae4df06bcdbdac7890d81f4
SHA1
26a05a1fc48a64236792235b1d799f66c32dbeb1
SHA256
5c201478354fcb5fa862bdb04ed1f66d75072a27ae3917a3ca781d7f8e7c9643
SHA512
fe1b07ced936271a087a57c0d630f1e839f7e661f7ddd6ab27fa27b76c7d6716490f2ac004de4bf507589e76fbd88043759e13752035bcff2b1476482a5c7b85
SSDEEP
768:xk5+mjZObvE9HwtAz4vsbTOiQf677po6nfWLRbKHFC3RmIKDKu+9+PwRO:x/IZObvE9H8Az4vsXOiQf677pjnfWNUy
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
4d9a85750ae4df06bcdbdac7890d81f4_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ