DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
5d936328899738f4c526884be29c9daa_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
5d936328899738f4c526884be29c9daa_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
5d936328899738f4c526884be29c9daa_JaffaCakes118
Size
48KB
MD5
5d936328899738f4c526884be29c9daa
SHA1
cde39e8ba82c7d81114c7cf7d9af87d0afc62117
SHA256
d7036b035f6de72b0055bf446f84cf61a71e9423f1e789ed7f876a9e2247b071
SHA512
6ee704590a4d278b239a5e2bdb41cf9e426f1428560a3e15b7779dcc0702628c65d024c49e6257154ef4ee86f54ef9b323431e838a80bfd0711441ded5d04078
SSDEEP
768:BQYi3XmFBCCZS7WRSwfkaGrm3pE5o9Q9xCuX0/fzanHuFSmmIz0S7:WfXm6VqRODrm5uoqCuXAanHuEFCd7
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
5d936328899738f4c526884be29c9daa_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ