DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5ba2bc28e0cb39c889c7c0639bae7a00_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
5ba2bc28e0cb39c889c7c0639bae7a00_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5ba2bc28e0cb39c889c7c0639bae7a00_JaffaCakes118
Size
15KB
MD5
5ba2bc28e0cb39c889c7c0639bae7a00
SHA1
4423183aad6590a4e6e56f27e82ab0c084e92faf
SHA256
296adf0b6b1775c6a56ebb6e78bd14d741fb122635e0cdfc44bb75a070e7786c
SHA512
fb9d1c9bf61e8f00f417ef68f7c3695fc8a6daeb7ff7f1641450ea95d5598b871c81aded9b0e1a2a6876818eb9e6ebd0b2e965801add3856c17e759a0bd9dc09
SSDEEP
192:c+HzQ2hsdmOWlhtb3YnDBbWgY/LvK58g2tHBMg+G5EPQELXETFpttKRdV5A:Tc9WljYD9i7PLOPLXEhpttKR
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5ba2bc28e0cb39c889c7c0639bae7a00_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ