DllCanReloadNow
DllUnregisterServerA
Behavioral task
behavioral1
Sample
5999a0259d962553dbff0d1780eacc7b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5999a0259d962553dbff0d1780eacc7b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5999a0259d962553dbff0d1780eacc7b_JaffaCakes118
Size
23KB
MD5
5999a0259d962553dbff0d1780eacc7b
SHA1
df4e59ff03226d747fce1b73e7f85b42ffac7acf
SHA256
aa6fd3108aa069bfcff58706138c78bee57f393a3fab4daac0523c7ff241e4d4
SHA512
85d43f1b5d93b8939f34f591756517bce2064e5b828d2d8062d7fceeb46a4554678c996752af254f719eefebee9156a31c1d8133c94c6029b0d394cc01136428
SSDEEP
384:QWsHMl+nsJiUNOEE7gC9dxhPqJb5yQnbNH+rGrp:JsH0d8EEcsNQZera
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5999a0259d962553dbff0d1780eacc7b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanReloadNow
DllUnregisterServerA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ