DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Behavioral task
behavioral1
Sample
65f8186f24cdaf3f6077db9be0329c5a_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
65f8186f24cdaf3f6077db9be0329c5a_JaffaCakes118.dll
Resource
win10v2004-20240709-en
Target
65f8186f24cdaf3f6077db9be0329c5a_JaffaCakes118
Size
24KB
MD5
65f8186f24cdaf3f6077db9be0329c5a
SHA1
1e8c8f0a4c0f6fb20f0c6935b9c2a49ea51f6ef4
SHA256
3d48364cc30956b25e19a1e40726fb5107132dd7ed2afc6c7f5285ce210156cc
SHA512
685410206810def76b326dc7e14d04a40e7d1ab3384e9fe9d737ef0759fed141db4003679e4cecc2cf97a5b275754fdfb0f1ca854224540380a973168aedb230
SSDEEP
768:WsTnfl4fHdKwXC7Pl+61itHsjVKm7Z2hgmyvwNwowma:Wmnf8HdtC7t6eQD9v
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
65f8186f24cdaf3f6077db9be0329c5a_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ