DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5c4b5c656adc5f2e50f983dabbb6cb46_JaffaCakes118.dll
Resource
win7-20240705-en
Target
5c4b5c656adc5f2e50f983dabbb6cb46_JaffaCakes118
Size
107KB
MD5
5c4b5c656adc5f2e50f983dabbb6cb46
SHA1
b2c50b5fea6f3aeaa993fb1a478dde72e2f65011
SHA256
dd349fc7b4a25e82128a1992292b2ed688012512dcf6db93bd9c83516e966e14
SHA512
c4c11246fa3d17ba914ff20c04abfd0934842f8cb5748fef4830952a1d5e7958ea76e26603c7a26f9681cd0d6b81d9f2bc7f7448d834b3afb9e7f04d9760b1d1
SSDEEP
3072:HrCLf2a6HN0+ShLU2L+V5EhhKwa5tbmuL+EFvRtcoM5:LKf2a2yhLU2L+VM5aDV/FRtZ
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5c4b5c656adc5f2e50f983dabbb6cb46_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ