DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitDll
InitO
Behavioral task
behavioral1
Sample
6552d4e32834030b2e4200cece12f0ae_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
6552d4e32834030b2e4200cece12f0ae_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
6552d4e32834030b2e4200cece12f0ae_JaffaCakes118
Size
53KB
MD5
6552d4e32834030b2e4200cece12f0ae
SHA1
e2caa19f5650aafec52c4bad9f8fbac9bb7692d2
SHA256
20f2a486a1a5204dd09cebc17b88e0abc3809f14013b39cd420a3b3fd7bc57c7
SHA512
8443748e8b34896a5e405d3e614bb9cd6e8f21b2aab81f588f1b2700c0fb459113324c5bb9b6a3c8f86c3c60e1416517f859204c35845f8c797fd2cc7d490cc0
SSDEEP
768:tCGovGerwco6bkhrS1JHhGCzSwFbKJhSqsogqNRT4+udR6L8b:tC5vGhc73HHhrSwFurRT4+L4
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
6552d4e32834030b2e4200cece12f0ae_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
InitDll
InitO
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ