DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5dea10da4767b52d6e3af00d80a5630e_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5dea10da4767b52d6e3af00d80a5630e_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5dea10da4767b52d6e3af00d80a5630e_JaffaCakes118
Size
6KB
MD5
5dea10da4767b52d6e3af00d80a5630e
SHA1
39390275e6d84824a96c1a97e420cf1738953d8a
SHA256
2bd6e244a8fd05c0ea4da86ac54ef5a17a7da273d1b3437036efa14fc3afb189
SHA512
af990d49bd4864f7a503dbdb74335405e7186aa061046367cbec31c78f2ea7b29ddec5ad3ba262c5826c98164a9ba8d5bc50e23f00f604bc7c1cc813f6c3b562
SSDEEP
96:/2Oclwfyg1sXplPPqFxMon0ivTL0ukCaAJBvRsE2D3VZpyeebjugA:zVRmf3qFxMonlUukCaaTsE2DJ8FA
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5dea10da4767b52d6e3af00d80a5630e_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ