DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5de99233d16c1b5e8c295c5ab0c9615b_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5de99233d16c1b5e8c295c5ab0c9615b_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5de99233d16c1b5e8c295c5ab0c9615b_JaffaCakes118
Size
45KB
MD5
5de99233d16c1b5e8c295c5ab0c9615b
SHA1
f7864bc6985fb45e6dfa7e0ceba29d77193dcd10
SHA256
16150b91d6c578c3faa3a198b3ef6bd49a0f82223686351b42d1d308edd10260
SHA512
1ff6ca556222792d51475e7132a6363e5402335fa7f5fc3ec9b4150679b283c75bca727dd0252a7bc10fe173404bf2e6bbabf1f00d5456c8b2b86a810d498e9c
SSDEEP
768:gvRNVcdJaf26zcrv2Eh6WbG/voR0lglR9/l2BQxdGeREiB/NCXR6UVG:gvRNVdf2xr5138glR9/l2OxdlTyR6YG
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5de99233d16c1b5e8c295c5ab0c9615b_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ